When a mailbox gets compromised, everyone wants to know how it happened. Fair question. It can wait a few minutes.
First, stop the attacker from using the account. Change the password, revoke active sessions, and check the sign-in and audit activity. Look for mailbox rules, forwarding, delegated access, and apps the user didn’t approve. Then find out what the account sent and who received it.
Contain it. Check it. Tell people.
Resetting the password alone may leave other access in place. The mailbox may have a rule forwarding messages. A session may still be active. Someone may have granted an app access. Check the pieces that let the attacker stay or come back.
If messages went to customers or coworkers, tell them plainly. Give them the subject line or time range and what to do if they opened an attachment or entered a password. Don’t hide behind “we take security seriously.” Tell them what happened and what you’ve done.
After things are stable, figure out how the sign-in happened and which controls need work. That’s when training, MFA coverage, access policies, and monitoring come into the conversation.
One thing to ask your provider: “If a mailbox is compromised tonight, who gets called, and what do you check before you call it resolved?”