An executive's account compromised. BEC stopped by XDR before any damage.

The challenge

At a 250-employee industrial company, an executive's (C-level) Microsoft 365 account was compromised: an account takeover, likely originating from a credential stolen via phishing. This is one of the most dangerous scenarios — Business Email Compromise (BEC): the attacker, with the authoritative identity of an executive, can issue credible fraudulent requests (payment instructions, confidential data, orders to staff). These attacks are silent: without behavioral detection, the intrusion stays invisible until the damage is done.

The solution

Acronis Advanced Security XDR, active on identity and email, detected the account takeover signals — anomalous access by location and device, unusual mailbox activity — and raised the alert before the attacker could complete the fraud. We responded immediately: account isolation, revocation of all active sessions, credential reset, verification and removal of any malicious forwarding rules created by the attacker. Then we hardened the posture: MFA and conditional access extended to all critical accounts, strengthened anti-phishing policies and Security Awareness Training to reduce the risk of a credential being stolen again.