Case study · Cyber security
Recovering a hijacked domain and email after an insider attack
A rogue employee hijacked a company’s domain and email, causing nearly a week of downtime. We recovered the domain, restored services within days and supported the police investigation.
What happened
Our client faced a serious threat from inside the business. A rogue employee attempted to hijack the company’s domain name and take control of its email server. With the domain under someone else’s control, the business lost its email and website, and the outage lasted for nearly a week.
For any business, a week without email is serious. Customers can’t get in touch, orders and invoices go unanswered, and the damage to reputation can outlast the outage itself. The client needed control back quickly, and they needed evidence to support action against the person responsible.
Taking back control
The first priority was to recover the domain. We started a formal dispute with an independent third party to establish the business’s rightful ownership of the domain, and to prevent any further malicious changes while the dispute was resolved.
Once ownership was confirmed and the domain was back under the client’s control, we restored email, the website and the related services. Everything was back up and running within days of starting the recovery, and the business returned to normal operation.
Supporting the investigation
Alongside the recovery, we helped the client build a clear record of what had happened, so the incident could be properly investigated:
- Detailed cyber incident reports setting out the timeline of events and the actions taken
- Video evidence compiled to support the investigation
- Coordination with lawyers, the police and UK cybercrime authorities, providing the technical information they needed
The incident was escalated for further investigation, with the evidence in place to support legal proceedings.
Preventing it from happening again
With services restored, we put stronger security measures in place to protect against insider threats. The aim was to make sure no single person could ever again take control of the business’s most important systems, and that access could be removed immediately when someone leaves.
The result
- The domain was recovered from the rogue employee, with full control returned to the business.
- Email, website and related services were restored within days, keeping further disruption to a minimum.
- A full evidence trail of incident reports and video evidence supported the police and legal investigation.
- Stronger protection against insider threats going forward.
What other businesses can learn
Many small businesses don’t know who really controls their domain name until something goes wrong. It’s often registered by whoever set up the website years ago, whether a former employee, a contractor or a previous web designer. If that person leaves on bad terms, your email and website go with them.
A few simple checks make a big difference:
- Make sure your domain is registered to the business, not to an individual, and that you know the login details for the registrar.
- Keep at least two trusted people with admin access to your domain, email and hosting, and turn on multi-factor login for every one of them.
- Remove access immediately when someone leaves, and change any shared passwords they knew.
- Turn on registrar lock, where your registrar offers it, to stop the domain being transferred without your permission.
Our five-minute security check covers these and other quick wins. If you’re not sure who controls your domain, or you need help after an incident, our IT support service can help.