--- title: "Account Compromise: What Recent European Cyberattacks Teach us" description: "Stolen credentials, privileged accounts, inbox rules: recent attacks show which signals reveal account compromise before data leaves." image: https://blog.idecsi.com/hubfs/compromission-de-compte-cyberattaques-recentes-dsi-3d.png --- [![Logo-Idecsi-Black-tagline](https://blog.idecsi.com/hs-fs/hubfs/LOGOS%20IDECSI/LOGOS%20OFFICIELS/Logo-Idecsi-Black-tagline.png?width=1010&height=319&name=Logo-Idecsi-Black-tagline.png)](https://www.idecsi.com/) - [Why IDECSI ?](https://www.idecsi.com/user-security/) - Solutions DETOX® pour M365 Audit, Remediation & ROI [Discover DETOX](https://info.idecsi.com/detox-m365?hsLang=en) ![Audit, Remediation & ROI](https://blog.idecsi.com/hubfs/ILLU-4.png) Solutions IDECSI gives security and IT teams full control over their data — across DSPM, Data Access Governance, Human Risk Management, and Data Volume Management. - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) M365 Data Security Platform](https://www.idecsi.com/solution/mydatasecurity/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Data storage optimization](https://www.idecsi.com/solution/mydatamanagement/) - Challenges M365 Checklist 15 Warning Signs Your M365 Data Is at Risk [Get the checklist](https://info.idecsi.com/checklist-15-warningsigns?hsLang=en) ![Checklist risques M365](https://blog.idecsi.com/hubfs/Frame-2147255341.png) Your 2026 Challenges Address your most critical data security and governance challenges - across your M365 environment - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Gain visibility accross M365](https://www.idecsi.com/challenges/visibility-microsoft-365) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Get Ready For Copilot M365](https://www.idecsi.com/challenges/m365-copilot/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Control external user access](https://www.idecsi.com/challenges/external-access-microsoft-365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Prevent Sensitive Data Exposure](https://www.idecsi.com/challenges/sensitive-data-m365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Gain visibility across Microsoft 365](https://www.idecsi.com/challenges/visibility-microsoft-365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Ensure regulatory compliance](https://www.idecsi.com/challenges/compliance-m365/) - Resources Is Your Tenant Ready for Copilot? A Security & Governance Playbook [Download](https://info.idecsi.com/whitepapper_copilot?hsLang=en) ![Copilot guide](https://blog.idecsi.com/hubfs/Frame-2147255339.png) Our resources Check out our useful resources for improving data protection - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Blog](https://blog.idecsi.com) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Help Center](https://help.idecsi.com/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Ressources & News](https://blog.idecsi.com/resources?hsLang=en) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) About us](https://www.idecsi.com/about-us/) - [Customers](https://blog.idecsi.com/resources-customer?hsLang=en) - - [English](https://blog.idecsi.com/account-compromise-detection) - [Français](https://blog.idecsi.com/fr/compromission-compte-cyberattaques) Search [Request a demo](https://info.idecsi.com/demo-idecsi?hsLang=en) Microsoft 365 12 November 2026 # Account Compromise: What Recent Cyberattacks Teach CISOs ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/compromission-de-compte-cyberattaques-recentes-dsi-3d.png) - [Home](https://www.idecsi.com/) - [Blog](https://blog.idecsi.com) - Account Compromise: What Recent Cyberattacks Teach CISOs In August 2026, France's finance ministry confirmed that an attacker had accessed the systems of its tax authority (DGFiP, the French counterpart to the IRS) and extracted data on nearly 678,000 individuals and businesses. The [incident report from France's national cybersecurity agency](https://cyber.gouv.fr/actualites/lanssi-publie-le-rapport-dincident-sur-les-cyberattaques-ayant-touche-la-dgfip/) (ANSSI, the French counterpart to CISA) reached a blunt conclusion: this account compromise was **not the result of a sophisticated attack**. The attacker simply signed in with valid employee credentials. This is not an isolated case. Across public agencies and private companies, on Microsoft 365 and on line-of-business apps, several major recent intrusions started with a legitimate account. Attackers no longer break in. They log in. For CIOs and CISOs, that changes the question. Blocking malicious sign-ins is still necessary, but it is no longer enough. You also need to spot what a seemingly legitimate account does with your data. ## What Is Account Compromise? Account compromise is the use of a legitimate account by an unauthorized person, through a username and password, an active session or an authentication token. The attacker then acts with the account owner's permissions. They can read, download, share or modify data without triggering the controls built to stop technical intrusions. The difference from exploiting a vulnerability matters for detection:   | **Criterion** | **Vulnerability exploitation** | **Account compromise** | | --- | --- | --- | | **Entry point** | A software or configuration flaw | Valid credentials or tokens | | **What the sign-in looks like** | Often abnormal technical behavior | A successful login, sometimes with MFA approved | | **Where the attack becomes visible** | On the exploited system | In how data and permissions are used |   Email accounts deserve special attention. They can be used to reset passwords for other applications and can serve as a starting point for privilege escalation. Security frameworks treat them as a priority: [MITRE ATT&CK catalogs malicious email forwarding rules](https://attack.mitre.org/techniques/T1114/003/) as a dedicated technique (T1114.003). ## Three Recent Account Compromise Cases In all three cases, the attacker relied on a valid account and then on its permissions.   | **Organization** | **Timeframe** | **Entry point** | **What the attacker did next** | | --- | --- | --- | --- | | **French tax authority (DGFiP)** | May to August 2026 | Stolen employee credentials, no strong authentication on two portals | Two waves of data exfiltration, both undetected | | **Storm-2949 (campaign documented by Microsoft)** | Report published May 18, 2026 | Self-service password reset abused through social engineering | Downloaded thousands of files in a single action | | **French public employment service** | Announced December 1, 2025 | Account of a staff member who manages access rights | Created two new accounts to browse case files |   ### Storm-2949: The Fake Help Desk as an Entry Point On May 18, 2026, [Microsoft documented a campaign by a threat actor it tracks as Storm-2949](https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/). The attackers triggered Microsoft Entra ID self-service password reset (SSPR) on behalf of the victim. They then posed as IT support to get the victim to approve the MFA prompts. Once in control, they removed the existing authentication methods and registered their own Microsoft Authenticator app. Targets included IT staff and senior leadership. In OneDrive and SharePoint, the attackers searched for documents on VPN configurations and remote access procedures. In one case, they downloaded thousands of files **in a single action** through the OneDrive web interface. The pattern repeated on every compromised account, since each identity could reach different folders. ### French Tax Authority: Valid Credentials, Missed Signals According to [ANSSI's report](https://cyber.gouv.fr/actualites/lanssi-publie-le-rapport-dincident-sur-les-cyberattaques-ayant-touche-la-dgfip/), the attacker used employee credentials stolen after they were used on personal devices, most likely through infostealer malware. Nearly 30 accounts were compromised, including 7 external accounts, according to [an analysis of the report by French tech outlet Next](https://next.ink/259041/piratage-de-la-dgfip-pas-dattaque-sophistiquee-mais-une-serie-de-defaillances-techniques/). Two portals that gave access to sensitive resources **had no strong authentication**. Warning signs existed: night-time logins, foreign IP addresses, VPN use. Nobody correlated them. Neither of the two exfiltration waves was detected, by the agency or by ANSSI. ### French Public Employment Service: The Account That Manages Everyone Else's Access Attackers compromised the account of a staff member responsible for approving access requests to a shared information system, then used it to create two new accounts. Those accounts gave access to the records of **about 1.6 million young people** supported by its local partner network, according to [the agency's December 1, 2025 statement](https://www.francetravail.org/files/live/sites/peorg/files/documents/Communiqu%c3%a9%20de%20presse/2025/20251201-%20CP%20-%20Le%20r%c3%a9seau%20des%20Missions%20locales%20et%20France%20Travail%20victimes%20dune%20cyberattaque.pdf). ## How Credentials Get Stolen in 2026 Four paths show up in recent incidents. None of them requires a flaw in the targeted system. - **Infostealer malware.** Installed on a personal or unmanaged device, it harvests saved passwords. It is the most likely explanation in the French tax authority case. - **Fake IT support.** On September 9, 2026, [Microsoft described a campaign active since May 2026](https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/). The attacker calls or messages the victim posing as the help desk, using a passkey, MFA or SSO update as a pretext. They then capture credentials and session tokens through an adversary-in-the-middle page, or trick the victim into approving a device code sign-in. - **Abuse of account recovery features.** Storm-2949 used self-service password reset to take over privileged accounts. - **Third-party accounts.** Contractors, partners and affiliated organizations hold legitimate access that is often less closely monitored. Both French public sector cases involve accounts outside the organization's core. In the September campaign, the attacker then registered an authentication method under their control to keep access. They mapped users and content through Microsoft Graph, then accessed SharePoint, OneDrive and email. Microsoft describes the exfiltration as potential: sign-in logs do not always prove which document was downloaded. To counter these techniques, Microsoft recommends **phishing-resistant MFA** such as FIDO2 security keys or Windows Hello for Business. ## How to Detect Account Compromise After Sign-In Once signed in, the attacker leaves traces in how data and permissions are used. Those traces are what you need to monitor, because the sign-in itself often looks normal.   | **Signal** | **Real-world example** | **Where to look** | | --- | --- | --- | | **Mass file access or downloads** | Storm-2949: thousands of files in one action | SharePoint and OneDrive audit logs | | **Inbox rule created right after access** | Proofpoint study, see below | Inbox rules and external forwarding | | **New authentication method registered** | Storm-2949, fake help desk campaign | Identity provider audit logs | | **Accounts created or permissions granted by an admin account** | French public employment service | Access management logs | | **Sign-ins at unusual hours or from unusual locations** | French tax authority | Sign-in logs | | **New rights on a mailbox or site (delegation, Full Access, Send As)** | Removed during containment in government response playbooks | Exchange and sharing permissions |   Inbox rules deserve close attention. [Proofpoint analyzed accounts compromised in Q4 2025](https://www.proofpoint.com/us/blog/threat-insight/mailbox-rules-o365-post-exploitation-tactic-cloud-ato): about 10% had at least one malicious inbox rule. In some cases, the rule appeared **about 5 seconds** after the account takeover. In companies, targets are mostly finance, payroll and executive assistant roles, all typical of business email compromise (BEC) and wire fraud. One signal alone proves nothing. A late-night login can be legitimate, and so can a large download. Correlation is what **turns signals into an alert**. In the French tax authority case, ANSSI pointed out that no mechanism correlated the suspicious signals. ## Why Sign-In Detection Is Not Enough Identity protection tools remain essential. But recent cases show three limits when they work alone. **The sign-in looks legitimate.** With valid credentials and an MFA prompt approved by the victim, authentication succeeds as normal. Both Storm-2949 and the fake help desk campaign rely on this. **A password reset does not always cut access.** ANSSI notes that resetting a password only works if the compromised device is also cleaned. In the French tax authority case, resetting a flagged account in late June did not stop the exfiltration already in progress. **The abused features are legitimate.** Self-service password reset, the OneDrive web interface, the Microsoft Graph API, access management tools: no malware is needed, so no antivirus fires. Detection therefore needs a second layer: what the account does after sign-in, on which data, and with which permissions. ## From Signal to CIO Alert: How to Respond An alert only pays off if it triggers fast action. For a compromised Microsoft 365 email account, [Microsoft's guidance lists six steps](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account) to secure and restore the account: 1. Disable the affected account until the investigation is complete. If you can't, reset the password and update app passwords, **which a reset does not revoke**. 2. Revoke user access to invalidate active sessions and refresh tokens. 3. Review the user's registered MFA devices and remove any unrecognized method. 4. Review applications with user consent and revoke those that shouldn't be allowed. 5. Review the admin roles assigned to the user and remove any that shouldn't be there. 6. Review mail forwarding and inbox rules, including hidden rules, and remove anything the attacker added. Microsoft then recommends reviewing Microsoft Entra sign-in and audit logs to establish what the attacker accessed, and when. To respond to these intrusions and threats, IDECSI’s solution provides a real-time advanced monitoring and alerting layer, operated by the AMT (Advanced Monitoring Team), its managed service team. The platform detects new sharing activity, risky access and suspicious sign-in attempts. It monitors unusual access patterns, abnormal locations and mass downloads, signals that help identify suspected fraud or account takeover. It also highlights risky permissions: administrator rights, full access to individual mailboxes, external forwarding, and rights to send on behalf of another user. These signals become prioritized alerts when a threat is detected, and can be forwarded to the SOC on the Advanced plan. The AMT supports the security teams of customers such as L’Oréal and SNCF. On the user side, [reviewing rights and access](https://blog.idecsi.com/rights-review-microsoft?hsLang=en) allows data owners to take part in resolving doubts about an alert, or in cleaning up the tenant after a confirmed compromise. ## Conclusion Recent account compromise cases share one thing: they are rarely caught at the door, and almost always caught in how data is used. An account that downloads thousands of files, creates a forwarding rule or grants itself new rights is a red flag, even when its sign-in was perfectly valid. For a closer look at how accumulated permissions widen the impact of a stolen account, read [why oversharing makes a compromised Microsoft 365 account far more dangerous](https://blog.idecsi.com/fr/phishing-microsoft-365-risques-donnees-partagees-1?hsLang=en).   ## Q&A Q1 : What is account compromise? Account compromise is when an unauthorized person uses a legitimate business account, through stolen credentials, a hijacked session or a stolen token. The attacker inherits the owner's access to email, files and apps. No technical vulnerability is needed to reach the data. Q2 : How do I detect a compromised Microsoft 365 account? Look for a new or unknown inbox rule, forwarding to an external address, a newly registered authentication method, or mass downloads from OneDrive or SharePoint. Sign-ins at unusual hours or from unusual locations are also warning signs. No single signal is proof: the combination is what justifies an investigation. Q3 : What's the difference between account compromise and a vulnerability exploit? A vulnerability exploit abuses a software or configuration flaw, so it often shows up as abnormal technical behavior. Account compromise uses valid credentials, so the sign-in looks normal. That is why account compromise is usually detected through data access and permission changes, not at login. Q4 : Do public companies have to report an account compromise? Only if the resulting incident is material. Under SEC rules adopted in July 2023, US public companies must disclose a material cybersecurity incident on Form 8-K (Item 1.05) within four business days of determining it is material. The rule is under review: the SEC chair requested comment on Regulation S-K in January 2026, and industry groups have asked for Item 1.05 to be rescinded, but it remains in effect as of October 2026. State breach notification laws may also apply when personal information is exposed. Q5 : What's the best way to stop account compromise from becoming a data breach? Combine phishing-resistant MFA, such as FIDO2 security keys, with monitoring of what accounts do after sign-in. Alerts on mass downloads, new forwarding rules and new permissions catch attackers who already hold valid credentials. In Microsoft 365, involving data owners in reviewing access speeds up triage and reduces false positives. Recent articles [Microsoft 365 Access Remediation: How DETOX Fixes Risk Faster](https://blog.idecsi.com/microsoft-365-access-remediation?hsLang=en) [How to Exclude a SharePoint Site From Copilot: 3 Methods in 2026](https://blog.idecsi.com/exclude-sharepoint-site-from-copilot-3-methods?hsLang=en) [Microsoft 365 Oversharing Remediation: DETOX Results from Abeille Assurances and LDC](https://blog.idecsi.com/m365-oversharing-remediation-detox-results-2026?hsLang=en) Best practices to improve Microsoft Teams security [![Download the infographic ](https://no-cache.hubspot.com/cta/default/4272098/825ad7d1-e961-4a7a-a6b3-6e380b22285f.png)](https://cta-redirect.hubspot.com/cta/redirect/4272098/825ad7d1-e961-4a7a-a6b3-6e380b22285f) Share this article Subscribe to our newsletter and receive new contents every month Our articles These articles may interest you ![M365 : how DETOX fixes risks faster](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/remediation-droits-acces-microsoft-365-detox-accelere-correction%20%281%29.svg) Microsoft 365 Security Microsoft 365 Access Remediation: How DETOX Fixes Risk Faster [Lire l'article](https://blog.idecsi.com/microsoft-365-access-remediation?hsLang=en) ![SharePoint: How to exclude a site from Copilot](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/exclure-site-sharepoint-copilot-3-methodes-2026-1.png) Microsoft 365 Security How to Exclude a SharePoint Site From Copilot: 3 Methods in 2026 [Lire l'article](https://blog.idecsi.com/exclude-sharepoint-site-from-copilot-3-methods?hsLang=en) ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/Co%C3%BBt%20du%20stockage%20Microsoft%20365%20en%202026.png) Microsoft 365 Microsoft 365 SharePoint Storage Costs in 2026: What's Changing [Lire l'article](https://blog.idecsi.com/microsoft-365-sharepoint-storage-costs-2026?hsLang=en) ### Data protection, let's discuss your project?   [![Contact us](https://no-cache.hubspot.com/cta/default/4272098/bea4f372-c84f-4ec4-980c-ca663747fbfe.png)](https://cta-redirect.hubspot.com/cta/redirect/4272098/bea4f372-c84f-4ec4-980c-ca663747fbfe) ![video background](https://idecsi2a-dev-idecsi.pf27.wpserveur.net/wp-content/uploads/2022/02/video-background-idecsi-responsive-1.png) [![Logo-Idecsi-White-Ss-ES](https://blog.idecsi.com/hubfs/LOGOS%20IDECSI/LOGOS%20OFFICIELS/Logo-Idecsi-White-Ss-ES.svg)](https://www.idecsi.com/) +33 1 84 79 38 30 - - - - [Why choose IDECSI?](https://www.idecsi.com/user-security/) - [About us](https://www.idecsi.com/about-us/) - [Join the team](https://www.welcometothejungle.com/fr/companies/idecsi) - Solutions - [Visibility](https://www.idecsi.com/challenge-data-visibility/) - [Detection](https://www.idecsi.com/challenge-threat-detection/) - [User engagement](https://www.idecsi.com/challenge-involve-user/) - [Access review](https://www.idecsi.com/challenge-rights-review/) - [Remediation](https://www.idecsi.com/challenge-remediation/) - [Sensitive data](https://www.idecsi.com/challenge-sensitive-data/) - [Products](https://www.idecsi.com/solution/) - [MyDataSecurity](https://www.idecsi.com/solution/mydatasecurity/) - [Advanced Monitoring](https://www.idecsi.com/solution/advanced-monitoring/) - [MyDataManagement](https://www.idecsi.com/solution/mydatamanagement/) - Resources - [Resources & News](https://blog.idecsi.com/resources?hsLang=en) - [Blog](https://blog.idecsi.com) - [Customer success](https://blog.idecsi.com/resources-customer?hsLang=en) - [Extranet](https://extranet.idecsi.com?hsLang=en) © IDECSI ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mona Piquet", "url" : "https://blog.idecsi.com/author/mona-piquet" }, "dateModified" : "2026-11-12T16:54:22.660Z", "datePublished" : "2026-11-12T16:54:22.000Z", "headline" : "Account Compromise: What Recent European Cyberattacks Teach us", "image" : [ "https://blog.idecsi.com/hubfs/compromission-de-compte-cyberattaques-recentes-dsi-3d.png" ], "mainEntityOfPage" : { "@id" : "https://blog.idecsi.com/account-compromise-detection", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.idecsi.com/hubfs/Logo-Idecsi-Black-tagline.png" }, "name" : "IDECSI" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Account compromise is when an unauthorized person uses a legitimate business account, through stolen credentials, a hijacked session or a stolen token. The attacker inherits the owner's access to email, files and apps. No technical vulnerability is needed to reach the data." }, "name" : "Q1 : What is account compromise?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Look for a new or unknown inbox rule, forwarding to an external address, a newly registered authentication method, or mass downloads from OneDrive or SharePoint. Sign-ins at unusual hours or from unusual locations are also warning signs. No single signal is proof: the combination is what justifies an investigation." }, "name" : "Q2 : How do I detect a compromised Microsoft 365 account?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A vulnerability exploit abuses a software or configuration flaw, so it often shows up as abnormal technical behavior. Account compromise uses valid credentials, so the sign-in looks normal. That is why account compromise is usually detected through data access and permission changes, not at login." }, "name" : "Q3 : What's the difference between account compromise and a vulnerability exploit?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Only if the resulting incident is material. Under SEC rules adopted in July 2023, US public companies must disclose a material cybersecurity incident on Form 8-K (Item 1.05) within four business days of determining it is material. The rule is under review: the SEC chair requested comment on Regulation S-K in January 2026, and industry groups have asked for Item 1.05 to be rescinded, but it remains in effect as of October 2026. State breach notification laws may also apply when personal information is exposed." }, "name" : "Q4 : Do public companies have to report an account compromise?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Combine phishing-resistant MFA, such as FIDO2 security keys, with monitoring of what accounts do after sign-in. Alerts on mass downloads, new forwarding rules and new permissions catch attackers who already hold valid credentials. In Microsoft 365, involving data owners in reviewing access speeds up triage and reduces false positives." }, "name" : "Q5 : What's the best way to stop account compromise from becoming a data breach?" } ] } ```