The Breach That Came From Inside the Tenant

A recent story making rounds in IT circles should make every small business owner pause: an organization discovered that attackers had infiltrated their Microsoft 365 environment, created a Global Administrator account, disabled security alerts, and rerouted hundreds of thousands of dollars to fraudulent accounts.

The worst part? By the time they discovered the breach, Microsoft's default 30-day log retention had rolled past the date the malicious account was created. They couldn't even see how the attackers got in.

This isn't a rare edge case. It's becoming disturbingly common, and small businesses are prime targets.

How These Attacks Actually Work

Let's break down the anatomy of a typical Microsoft 365 tenant breach:

Step 1: Initial Access Attackers typically gain entry through phishing emails, credential stuffing (using passwords leaked from other breaches), or exploiting accounts without multi-factor authentication. One compromised user account is all they need.

Step 2: Privilege Escalation Once inside, sophisticated attackers don't immediately steal data. They quietly explore the environment, looking for ways to elevate their access. They might find an account with admin privileges, exploit a misconfigured permission, or use legitimate Microsoft tools against you.

Step 3: Persistence Here's where it gets scary: attackers create their own Global Administrator account or add themselves to existing admin roles. They set up mail forwarding rules, disable security alerts, and establish multiple backdoors.

Step 4: Monetization With full control, they monitor email for financial transactions, intercept invoices, change banking details, and redirect payments. By the time anyone notices, the money is gone.

Why Small Businesses Get Hit Hardest

Enterprise organizations typically have dedicated security teams, extended log retention, SIEM solutions, and 24/7 monitoring. Small businesses? Most are running with default Microsoft settings and hoping for the best.

The attackers know this. They specifically target smaller organizations because:

• Default configurations are often unchanged: Microsoft's out-of-box settings prioritize usability over security
• MFA adoption is inconsistent: Maybe the owner has it enabled, but does the bookkeeper? The sales team?
• Nobody's watching the logs: Even if suspicious activity generates alerts, who's reviewing them?
• Limited IT resources: There's no dedicated security person, and the IT admin is juggling a hundred other priorities

Practical Steps to Protect Your M365 Environment

The good news: most of these attacks are preventable with basic security hygiene. Here's what actually moves the needle:

Enable MFA on Every Account—No Exceptions This single step blocks the vast majority of credential-based attacks. Use Microsoft Authenticator or hardware keys, not SMS when possible. Make it mandatory for all users, especially anyone with admin access.

Audit Your Admin Accounts Monthly Know exactly who has Global Administrator, Exchange Administrator, and other privileged roles. If you see an account you don't recognize, investigate immediately. Most small businesses should have no more than 2-3 Global Admins.

Extend Your Log Retention Microsoft's default 30-day retention isn't enough. Upgrade to Microsoft 365 E5 or add a third-party logging solution. When (not if) you need to investigate an incident, those logs are invaluable.

Review Mail Flow Rules Regularly Attackers love creating rules that forward emails to external addresses or move messages to hidden folders. Check your transport rules and user-level inbox rules monthly.

Implement Conditional Access Policies Block logins from impossible locations, require MFA for admin actions, and restrict access to managed devices where feasible.

Run Regular Vulnerability Scans Your M365 environment doesn't exist in isolation. Vulnerabilities in your network, web applications, or connected systems can provide attackers the foothold they need. Regular scanning identifies misconfigurations and security gaps before attackers exploit them.

The Real Cost of "We'll Deal With It Later"

The organization in that Reddit post lost hundreds of thousands of dollars. But the full cost goes beyond the stolen funds:

• Forensic investigation fees
• Legal and compliance costs
• Customer notification requirements
• Reputation damage
• Increased insurance premiums
• Lost productivity during recovery

For a small business, a breach of this magnitude can be existential. The average cost of a data breach for small businesses now exceeds $150,000—enough to close many companies permanently.

Take Action Today

Don't wait for attackers to find your vulnerabilities first. The organizations that avoid becoming cautionary tales are the ones that take proactive steps: enabling MFA, auditing admin accounts, and running regular security scans to catch misconfigurations before they become breach headlines.

Oscar Six Security's Radar solution provides automated vulnerability scanning for just $99—giving you the visibility you need without enterprise-level costs. Whether you're working toward CMMC compliance, seeking Ohio SB 220 safe harbor protection, or simply want to sleep better at night, regular scanning is foundational.

Focus Forward. We've Got Your Six.