'Cybersecurity Tips for Your Business' is an initiative of the Greater Langley Chamber of Commerce, in partnership with our IT and cybersecurity Chamber members, to bring businesses practical tips, insights, and resources to help keep their operations secure.

Cyber threats are an increasing concern for businesses of all sizes, and even organizations with security measures in place can be vulnerable. By sharing real-world experiences and expert advice from our members, we hope to help local businesses recognize potential risks and take proactive steps to protect themselves.

Read the case study below from Chamber member Cloud Systems to learn how accounts can be compromised even when passwords and verification codes are in place, and what businesses can learn from the experience.

When the Password and the Code Are Not Enough
Lessons for small businesses from a real email account takeover

Most small business owners have been told that if they turn on multifactor authentication, their email is safe. It is good advice and everyone should do it. But it is not the whole story. Earlier this year we responded to an account takeover at a small local firm that had multifactor authentication switched on, did nothing obviously wrong, and still lost six weeks to an attacker sitting quietly inside its email. The details here are anonymized, but the pattern is one every business should understand, because it is common and it is becoming more so.

What happened
The attacker did not guess a password or break through a firewall. They sent an employee to a fake login page that looked exactly like the real Microsoft sign in. The employee entered their password and approved the multifactor prompt, just as they would on any normal day. In the background, the fake page passed those details straight to the real Microsoft and captured the live session, the digital token that says this person is already signed in. With that token, the attacker no longer needed the password or the code. They were in.

For about six weeks, they simply read. They opened hundreds of emails, including client financial documents, and through shared mailbox access they reached into colleagues' inboxes and shared files as well. They sent nothing. They stole no money. They changed nothing. That is exactly why nobody noticed. To every normal security check, the activity looked like a legitimate employee reading their own email from a browser. It was caught in the end not by the standard tools but by a newer layer of monitoring that watches for this kind of session and identity abuse.

Why the usual defenses missed it
This technique has a name, Attacker in the Middle, and its whole purpose is to defeat multifactor authentication. Multifactor stops someone who has only stolen your password. It does not stop someone who tricks you into approving the login yourself and then steals the session that follows. Once the attacker holds a valid session, standard email security sees a valid, authenticated user. No failed logins, no password resets, no alarms. That is why so many of these compromises run for weeks before anyone notices.

Why nothing was stolen is the wrong measure
It is tempting to look at a case like this and feel relieved. No money moved. No fraudulent emails went out. But that is not where the damage lands. The moment an outsider can read client financial and personal information, a business inherits a set of obligations that have nothing to do with whether money was taken. In this case the fallout included being locked out of the systems the business needed to do its work, weeks of investigation and cleanup, legal and privacy questions, and the hard job of deciding which clients to notify and how. The heist was never the point. The cleanup was the cost, and it was substantial.

The wider blast radius
One more lesson worth drawing out. A single compromised account rarely stays contained to one mailbox. Because that account had delegated access to colleagues' mailboxes and shared files, so did the attacker. The more access an account carries, the more an intruder inherits when they take it over. Giving every account only the access it genuinely needs is not bureaucracy, it is damage control for the day something goes wrong.

What actually helps
None of this needs a big budget. It needs the right small moves:
● Move toward phishing resistant sign in, such as passkeys or hardware security keys, which cannot be handed to a fake page the way a code can.
● Turn on sign in rules that question logins from unfamiliar locations, block outdated sign in methods, and add friction to risky sessions.
● Add identity monitoring that watches for stolen sessions and unusual access, not just wrong passwords.
● Review who has access to what. Trim delegated mailbox access and shared file permissions to only what each person needs.
● Teach your team that approving a login prompt on a page you were sent to can still be a trap. Check the web address before entering anything.
● Make it safe for employees to speak up quickly if something feels off or they think they clicked something they should not have. There should be no guilt or shame in reporting a mistake; that simple act can be the difference between a quick reset and thousands of dollars in cleanup, legal exposure, and damage to the company's reputation.
● Verify any request to move money, change banking, or update account details by phone, using a number you already have, never the one in the email.
● Write down your incident steps and who to call before you need them. The middle of a breach is a bad time to improvise.
● If you handle regulated or client financial data, learn your breach notification obligations in advance.

The takeaway
The uncomfortable part of this case is that the business did the thing it was told to do. It had multifactor authentication. What it did not have was the next layer, the monitoring and the sign in controls that catch a stolen session, and a clear plan for the day something slips through. Those are within reach of any small business, and they are a great deal cheaper than the cleanup. If this account takeover teaches one thing, it is that safe is not a box you tick once. It is a set of habits, and the businesses that fare best are the ones that build them before they are tested.

Download the article >

_{This article was contributed for educational purposes by Geoff Beulens of Cloud Systems, a Langley based IT and cybersecurity firm. It is drawn from a real incident, anonymized to protect the business involved.}