Situation
An e-commerce company in Kaunas, Lithuania sells home and garden products in Lithuania and the Baltic countries. It has 40 people: customer service, marketing, purchasing and the warehouse. Email and calendars were with a local hosting provider, the same one that had built the first web shop many years earlier. Mailboxes had limited capacity, there was nowhere to keep shared documents, and employees shared files through personal cloud accounts.
There were also shared accounts: “info”, “orders” and “purchasing”. Several people logged in to each with the same password, often from personal phones. Nobody had two-factor verification.
The incident happened in the autumn, at the start of peak season. A purchasing manager received an email, supposedly from a supplier, with a link to an “updated invoice”. She entered her email password on a forged page. Within a few hours emails were sent from her account to all her contacts, and one supplier received a request to change a bank account for payment. The supplier called to check, so no money was lost, but the company’s manager realised it had been luck, not protection.
What was needed
Together with the company’s manager and the head of customer service we agreed the goals:
- Move email, calendars and contacts to Microsoft 365 so that customer service would not feel any interruption. During the season every hour of unanswered email means lost orders.
- One identity for every employee, with no shared passwords, and shared mailboxes set up as shared mail resources rather than separate accounts.
- Two-factor verification for everyone without exception, managers included.
- Protection against phishing emails before they reach employees.
- Email and document backups that are independent of Microsoft.
- Deadline: before the biggest sales of the year, which meant four weeks.
What we did
Week 1: preparation and identities
We created a Microsoft 365 tenant, verified the domain and started with identities: a personal Microsoft Entra ID account for every employee, and the shared mailboxes “info”, “orders” and “purchasing” became shared mail resources that specific people access with their own accounts. It is now visible who replied to which email.
In parallel we prepared the migration plan: mail history is copied to Microsoft 365 in advance, several times, while both systems are running, and the cutover happens only by changing the domain’s mail records.
Week 2: migration with no downtime
We migrated the mail history, and some mailboxes held ten years of email. On Wednesday evening we switched the domain records, and the next morning employees were already working in Microsoft 365. Emails that arrived during the cutover hours were collected from the old system and moved over. Not a single email was lost, and customer service worked as usual.
The hardest part was the web shop and warehouse systems, which sent automatic emails to customers through the old mail server. We reconfigured them in advance and tested them so that order confirmations would not be interrupted.
Week 3: security
We turned on two-factor verification for everyone through a phone app. We configured conditional access: logins from unknown devices or unusual countries are blocked, and the legacy protocols used by phishing attackers are disabled. Employees’ phones that hold work email were enrolled in device management, so if a phone is lost, the work data is wiped remotely.
Email filters were configured following Microsoft 365 security practice: links in emails are checked at the moment of the click, attachments are opened in a protected environment, and emails from abroad using our managers’ names are flagged as suspicious. Managers, whose names are most often forged, got additional impersonation protection.
Week 4: backups and training
We turned on Microsoft 365 backup with Veeam: email, OneDrive, SharePoint and Teams are backed up daily to our data centre in Lithuania (EU), independently of Microsoft. A deleted email or document is restored in minutes, not through a Microsoft support request.
In the last week we ran one-hour training for all employees: how to recognise a forged email, what to do if you clicked, and why a change of bank details must always be confirmed by phone. After the training we started periodic phishing simulations, simulated emails that show who still clicks.
Result
In the six months after the migration there was not a single successful phishing case. We measure this in two ways: the security dashboard shows every blocked email and login attempt, and the simulated phishing emails show how employees react. In the first test a few people clicked; in the third, nobody did.
Email downtime during the migration was 0 hours: customer service worked the whole time, and the cutover took place in the evening. All 40 accounts, 100%, have two-factor verification and conditional access, and shared passwords no longer exist. Every email or file deleted by mistake is restored from backup; over the half year there were four such requests, all completed the same day.
After the incident I thought security would mean inconvenience. It turns out the inconvenience was before, we just did not notice it.
What we would advise in a similar situation
- Shared accounts with a shared password are the biggest risk at small companies. You can have shared mailboxes, but people should log in to them with a personal identity.
- Two-factor verification for everyone, managers included. Managers’ accounts are exactly the ones attackers value most.
- When migrating email, copy the mail history in advance and cut over only the domain records. Then the downtime is zero, not a weekend.
- Microsoft protects your email, but it is not responsible for what you delete yourselves or what an attacker deletes. A copy outside Microsoft is not excess, it is the standard.
