October 30, 2026
If an Alberta law firm’s Microsoft 365 account is compromised, the immediate priorities are to contain the account, secure access, determine what happened, recover safely, and assess any reporting obligations.
Speed matters. A compromised account can potentially expose email, confidential information, contacts, or other Microsoft 365 resources. It may also be used to impersonate a lawyer or employee and send additional phishing messages.
A useful incident-response framework is:
Contain → Secure → Investigate → Recover → Report
Here is what those five steps mean in practice.
1. Contain the Compromised Account
The first objective is to stop the attacker from continuing to use the account.
Depending on the incident and Microsoft 365 configuration, the response may include:
- Blocking or restricting account access
- Expiring active sessions
- Resetting compromised credentials
- Reviewing MFA methods
- Preventing suspicious forwarding or email activity
- Isolating affected devices if necessary
Simply changing the password may not be enough if an attacker already has an active session or has made other changes to the account.
This is one reason law firms should have an incident-response process established before an account is compromised.
2. Secure the Account and Related Systems
Once immediate access has been contained, determine what else may need protection.
Ask:
Was MFA enabled?
Were MFA settings changed?
Were new authentication methods added?
Were email forwarding rules created?
Were other accounts targeted?
Could the compromised credentials have been reused elsewhere?
This stage is about preventing one compromised account from becoming a larger incident.
For Microsoft 365 environments, Techwel manages areas including MFA configuration, user access, advanced email security and phishing filtering, data backups, and security monitoring and alerts.
3. Investigate What Happened
Next, determine how the compromise occurred and what the attacker did.
Review available security information such as account activity, alerts, suspicious logins, and changes made within the environment.
The investigation should try to answer four questions:
How did the attacker get in?
When did the compromise occur?
What did the attacker access or change?
Did the attack affect anyone else?
Those answers can influence both the technical response and any legal, insurance, privacy, or professional reporting obligations.
Avoid assuming that restoring access to the employee means the incident is over.
4. Recover and Prevent the Same Attack From Happening Again
After the immediate threat is addressed, use the incident to identify weaknesses.
That may involve strengthening MFA, adjusting access, improving phishing protection, reviewing endpoint security, restoring information from backups, or providing additional employee security education.
Consider what failed and what worked.
One Techwel Computers client experienced a real example of this when a shared mailbox was compromised through a password-phishing attack on a Sunday afternoon.
Techwel Computers’ monitoring tools and automated responses detected the incident. The account was locked down, active logins were expired, and the attacker was logged out before any damage was done.
The important lesson wasn’t simply that phishing occurred.
It was that security monitoring and response continued when the office was closed.
5. Determine What Needs to Be Reported
For an Alberta law firm, incident response isn’t exclusively an IT issue.
In February 2026, the Law Society of Alberta warned that it had received reports of Alberta law firms being hacked and cybercriminals gaining access to client files.
The Law Society advises that, depending on the circumstances, a cybersecurity breach may create reporting obligations involving parties such as:
- Affected clients
- Alberta Lawyers Indemnity Association (ALIA) or another insurer
- The Office of the Information and Privacy Commissioner of Alberta (OIPC)
- The Law Society of Alberta’s Trust Safety department
The appropriate reporting obligations depend on what happened. A law firm should obtain appropriate legal, privacy, insurance, and professional guidance rather than assuming every cybersecurity incident has identical requirements.
The Law Society also has specific reporting requirements concerning certain fraud or theft involving firm money, trust accounts, general accounts, or trust property.
Prepare Before an Account Is Compromised
The best time to determine how your firm will respond to a Microsoft 365 compromise is before one occurs.
Start with five questions:
- Who receives our Microsoft 365 security alerts?
- Who can disable an account and expire active sessions?
- Who investigates suspicious activity?
- How will we recover affected data if necessary?
- Who determines our reporting obligations?
Write down the answers.
An incident at 2 p.m. on a Sunday shouldn’t require your firm to start figuring out who is responsible.
How Can Law Firms Reduce the Risk?
No cybersecurity measure can guarantee an account will never be compromised.
Instead, use layers of protection.
For Microsoft 365, that can include MFA, controlled user access, advanced email and phishing filtering, Microsoft 365 data backups, and security monitoring and alerts.
Think of those layers as:
Prevent → Detect → Respond → Recover
Prevention makes successful attacks more difficult. Detection helps identify suspicious activity. Response helps contain an incident. Recovery helps the business return to normal operations.
Microsoft 365 Security Support for Edmonton Law Firms
Techwel Computers is a family-owned Edmonton IT company providing managed IT, cybersecurity, and Microsoft 365 management.
We help businesses with MFA configuration, user onboarding and offboarding, advanced email security and phishing filtering, Microsoft 365 data backups, and security monitoring and alerts.
We also provide remote and on-site support, and when our clients call, a person answers the phone—there’s no phone tree.
For a 10 - 50 employee Edmonton law firm, the goal isn’t to assume an account compromise will never happen. It’s to have layers of protection and a response plan in place so the firm is prepared if it does.
Book a Discovery Call with us: https://www.techwelcomputers.com/discoverycall/
