The way attackers break into Microsoft 365 has changed. Your defense hasn't.

A 22-person design firm. Thursday afternoon. The accounts clerk receives an email from the CEO: "Hi Priya, please wire $47,000 to this vendor today — it's for the new contract. Invoice attached. I'm in meetings all day so just confirm by email when done." The email is from the CEO's actual address. The writing style matches. She wires the money. It's gone in 30 minutes to a mule account in another country. Only problem: the CEO never sent it.

A 60-person manufacturing company. IT proudly told management: "We have multi-factor authentication — we're secure." Then the finance head clicked a link in a "DocuSign invoice" email. It looked like the real Microsoft login page. He typed his password. Entered his MFA code. The page showed "Session timeout, please try again" and he closed the tab. What he actually did: handed the attacker his live session cookie. The attacker was now logged in as him — no password needed, MFA already satisfied. They read his mail for two weeks. Then they redirected $180,000 in vendor payments.

A 40-person law firm. An associate received an email: "Secure document from court system — click to view." The link opened a genuine Microsoft consent page asking permission to grant "Court Docs Viewer" access to her mailbox and files. It was a real Microsoft page, so she clicked "Accept." No password taken. No MFA bypassed. But now a malicious third-party OAuth app had persistent permission to read every email, every file, every calendar entry. The attacker had silent, password-less access for 6 months before it was discovered during an audit. Client confidentiality? Destroyed.

A 150-person SaaS startup. An IT admin's password was leaked in an unrelated data breach months earlier. At 2 AM, his phone started buzzing. Approval notifications from Microsoft Authenticator. One. Five. Fifteen. Fifty. Half-asleep, frustrated, he tapped "Approve" — just to stop the buzzing. The attacker was instantly in as Global Admin. Within 4 minutes: new admin account created, audit logs disabled, customer database being exfiltrated. Total damage: regulatory fines, customer churn, a $340,000 incident response bill, and 6 months of painful disclosure calls.

An 80-person marketing agency in London. A junior designer needed to share a client brief with an external contractor. He right-clicked the file in OneDrive, picked "Copy link," and WhatsApp'd it over. He didn't notice the default setting said "Anyone with the link can view." Six months later, a routine audit discovered that same folder contained 340 files — including signed employee contracts, unreleased campaign creative for a listed company, and a spreadsheet with 12,000 customer email addresses. All of it accessible to anyone with any of those "anyone" links — which had been shared hundreds of times. The ICO investigation came next. €420,000 fine.

A 120-person logistics company. The operations manager got a Teams chat request from "Sarah — IT Support Consultant" with a credible LinkedIn photo. She accepted — Teams had external chat enabled by default. Sarah was friendly, helpful, spent a week chatting about ops challenges. Then one day she sent over "an optimization dashboard we built for clients like yours" — an Excel file with a macro. He opened it on his work laptop. Ransomware deployed across 84 machines in 6 hours. Sarah disappeared. Total cost including downtime, ransom negotiation, and recovery: $95,000.

A 45-person healthcare services company. The Head of Sales left her laptop bag in an Uber. Standard laptop, standard loss — except the laptop had no encryption, no Intune enrollment, no conditional access tying it to a managed device. Her Outlook had 4 years of mail cached offline. Her OneDrive had the master customer spreadsheet with 6,200 patient names, DOBs, and treatment histories. She logged into M365 from home to "change her password," thinking that solved it. It didn't. Under HIPAA breach rules, the company had to notify all 6,200 patients, pay for 12 months of credit monitoring, and report to regulators. Total cost: $220,000. Plus reputational damage that cost them three major contracts.

A 35-person B2B software consultancy. A senior account manager resigned on a Monday with two weeks notice. By Friday, the sales head noticed something weird in the OneDrive activity logs: the resigning employee had downloaded 4,800 files over 72 hours — entire client pipeline, proposals, contracts, pricing models. He'd also set up an auto-forward of his corporate email to a personal Gmail. He joined a direct competitor the following month. Within 90 days, 4 of the consultancy's top 10 clients moved to the competitor. Nothing technically illegal happened. Nothing technically stopped it either.