#37511 [email protected] account compromise

Liz,

Here's the rundown. 

On February 17, 2026 at 11:55:17 AM, the email account belonging to Anna Christensen ([email protected]) was compromised by an unauthorized third party. The attacker maintained persistent access to the account for 22 days before launching a phishing campaign on March 11, 2026. The compromised account belongs to the Arc Apartments / Farran Property Management organization (farranmgmt.onmicrosoft.com).

On March 11, 2026 at 13:29:36 UTC, the attacker sent a phishing email titled “Anna Christensen Shared Document Via OneDrive” from Anna’s account to 84 recipients — a mix of internal staff, tenants, vendors, and external contacts.

Immediately after sending, the attacker:

13:29:40 — Deleted the sent email from Sent Items
13:30:05 — Created a second malicious inbox rule (named “.”) that deletes ALL incoming email with no filter, to suppress bounce-backs and replies
13:30:13 — Deleted auto-replies and undeliverable notifications
13:48:35 — Performed additional cleanup of remaining bounce-backs
14:30–14:31 — Monitored for and deleted replies to the phishing email

Delivery Results

Status	Count
Delivered	65
Failed	15
Pending