FR-02 · Incident · Worldwide Clinical Trials · 2021–2026
Three mail-bomb campaigns, contained in minutes
Coordinated floods aimed at high-value mailboxes, and a response that crossed the gateway, the directory, and the SOC.
- coordinated campaigns
- 3
- high-value mailboxes targeted
- 30 to 45
- from first wave to contained
- 5 to 15 minutes
Context
Three coordinated mail-bomb campaigns hit between 30 and 45 high-value mailboxes. Floods like these can bury a message that matters, such as a password-reset or payment-change notice, under junk mail.
Constraints
- The targets were high-value mailboxes the business relied on.
- Containment had to be coordinated across Mimecast, Entra ID, and the Security Operations Center.
What I did
- Identified each campaign from its first wave and served as the incident escalation point.
- Coordinated containment across Mimecast, Entra ID, and the SOC.
Outcome
Each campaign was contained within 5 to 15 minutes of its first wave, with no business disruption.
Field Notes
- Three mail bombs, contained in minutesSheet 16 / 30
Tags
- Incident response
- Mimecast
- Entra ID
- SOC
- Exchange Online