How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articleSigns of a compromised account: colleagues receive strange emails from you, you see logins from unknown places, new inbox rules appear, or a service tells you that your password was found in a leak. Acting quickly limits the damage.
Before you start: tell your IT team or provider immediately — they can see logs and block access faster. Do not delete suspicious emails or rules before IT has seen them: they help understand what happened.
Step 1. Change the password from a clean device
Use a device you trust, choose a new unique password and sign out all active sessions (in Microsoft 365 and Google this is available to administrators and in account security settings).
Step 2. Turn on or reset MFA
Enable two-factor authentication if it was not on. If it was, check the registered methods and remove any phone or app you do not recognise.
Step 3. Check for traps left by the attacker
Look for inbox rules that forward, delete or hide emails, forwarding to external addresses, connected apps with access to your mailbox, and changed recovery phone numbers or email addresses.
Step 4. Change reused passwords
If the same password was used anywhere else — another service, a personal account — change it there too. Then start using a password manager.
Step 5. Warn the people who may be affected
If phishing or fake invoices were sent from your account, warn clients and partners by phone or from another channel, so they do not pay or open attachments.
Speed matters more than perfection: change, block, check, warn.
Need help with this? Contact CySec for a free consultation.