Business Email Compromise at a Freight Forwarder with a Flat Network
A freight forwarder with 120 employees, $480 million in annual freight under management, and a single IT generalist has suffered a suspected business email compromise. A customer’s finance team paid $186,000 to a new bank account after receiving an email that appeared to come from the forwarder’s operations manager. The forwarder’s mail gateway shows an inbox rule that forwards all messages containing “invoice” to an external address, and the operations manager’s mailbox was accessed from an unfamiliar country. The forwarder runs an on-premises TMS on a flat network, uses the same local administrator password on 30 servers, has MFA only on email, and allows vendor VPN access without MFA. EDI connections to 40 carriers are working, but the TMS is showing delayed status updates. The insurer has asked for containment evidence within 48 hours; the customer wants assurances before tendering more freight. The CEO wants to restore normal operations immediately and avoid notifying other customers. The security lead must set priorities for the first 72 hours.
1. Set the first-72-hour containment and notification priorities. How would you handle the CEO’s preference to avoid notifying other customers?
Read the worked answer
Contain first, then scope, then notify. Disable the compromised mailbox, revoke active sessions and tokens, reset credentials, and block the external forwarding address and sender domain. Preserve mailbox rules, logs, headers, and a forensic image before cleanup. Check whether the attacker accessed the TMS, EDI credentials, or vendor VPN accounts; reset shared administrator passwords and require MFA for VPN and remote access immediately. Isolate affected servers if compromise is confirmed, but keep EDI and TMS operations running through controlled accounts where possible.
Notify the bank and the affected customer promptly so they can attempt recall and protect other payments. Engage legal counsel and the insurer, and determine breach notification obligations with counsel. The CEO’s preference cannot override contractual, legal, or insurer requirements. Other customers should receive a factual notice if their data or payment instructions may be affected; delay increases fraud risk and erodes trust. A short holding statement can say the incident is contained, forensic review is underway, and payment-change requests will be verified by call-back.
2. Prioritize remediation for a 120-person company with one IT generalist. What should be done in 30, 60, and 90 days?
Read the worked answer
In the first 30 days, close the access paths that enabled the incident: MFA on all remote access, VPN, email and administration; unique local administrator passwords stored in a vault; removal of stale vendor accounts; and a verified call-back process for any bank-detail change. Add mailbox rule monitoring and alerting for external forwarding. Take an offline backup and test restoration. Retain an incident response firm or establish a retainer.
In 60 days, segment the TMS and EDI environment from user endpoints and the internet. Restrict EDI credentials by function and log all changes. Harden email with DMARC enforcement and external-sender warnings. Implement least privilege and a privileged access review. Train finance and operations staff on payment fraud using the actual incident, without blame.
In 90 days, adopt a written incident response plan with roles, contact trees and a tabletop. Add endpoint detection, centralized logging, and a vulnerability remediation cycle. Given the single IT generalist, use a managed security provider for monitoring and backup verification. Track MFA coverage, admin password uniqueness, phishing reports, and time to contain as board metrics.
3. What assurance should the forwarder give the customer, and what evidence should support it?
Read the worked answer
The forwarder should give a bounded assurance, not a guarantee. State what happened, what was contained, what remains under forensic review, and what controls now protect payment and shipment data. Avoid claiming that no other mailbox or system was affected until the scope is confirmed.
Support the assurance with evidence: the containment timeline, affected accounts and remediation, MFA enforcement reports, password vault adoption, EDI/TMS access review, mailbox rule audit, and the new bank-change verification procedure. Offer the customer a direct call with the incident lead and a written point of contact for verification. If appropriate, provide a third-party forensic summary or attestation letter under legal privilege.
Commit to a follow-up date and report progress against specific actions. The customer is likely evaluating whether the forwarder can be trusted with payment instructions and shipment visibility. Transparency about residual risk is stronger than a blanket denial, especially when the customer’s own finance team was the fraud victim.