Employee Clicked a Phishing Link? Your 30-Minute Action Plan

It is 10:47 a.m. on a Tuesday. Your front-desk coordinator walks in and says the words every Memphis business owner dreads: “I think I just clicked on something I shouldn’t have.” If you are reading this during an active incident, skip to First 5 Minutes right now – everything else can wait. If you are reading to prepare, even better. When an employee clicks a phishing link, what to do in the first 30 minutes determines whether you spend $500 cleaning up or $108,000 rebuilding.

Phishing is the entry point for 80% of reported security incidents at small businesses. Median time-to-click on a malicious email is under 60 seconds, and AI-generated phishing produces click-through rates more than four times higher than human-written attempts. We have walked Memphis dental practices, warehouses, and CPA firms through exactly this scenario, and the firms that recover cleanly all do the same things in the same order. This post is that playbook.

First 5 Minutes – Contain the Damage

Containment is the only thing that matters in the first five minutes. Investigation and root-cause analysis are for later. Your job right now: stop the spread and stop the credentials from being used.

Do these four things, in this order:

1. Disconnect from the network – do NOT power off. Pull the Ethernet cable. Turn off Wi-Fi. Powering off destroys volatile memory evidence and can trigger ransomware to encrypt faster. Leave it running, unplugged, on the desk.
2. Tell the employee they are not in trouble. Fast reporting is the single biggest factor in clean recovery. If staff fear they will be fired, they will hide it. A calm “thank you for telling me immediately” gets you to recovery faster than any technical control.
3. Lock the affected account. From a different device – your phone, a coworker’s laptop, anything but the compromised machine – sign in to your Microsoft 365 or Google Workspace admin console and reset the user’s password. Revoke active sessions. If you have MFA, regenerate the user’s MFA secret (force re-enrollment).
4. Call your IT provider. If you have a managed IT services agreement with response-time guarantees, this is what you pay for. If you are running break-fix, you are already losing time you cannot afford. Either way: pick up the phone.

Five minutes is not enough to figure out what was stolen. It is exactly enough to stop the bleeding.

What should you do immediately after an employee clicks a phishing link? Disconnect the device from the network without powering it off, reset the user’s Microsoft 365 or Google Workspace password from a different device, revoke active sessions, regenerate MFA, and call your IT provider. These four steps in the first five minutes prevent most post-click compromises from escalating into credential abuse, data theft, or ransomware deployment.

Minutes 5-30 – Assess What Was Compromised

You have stopped the immediate spread. The next 25 minutes are about evidence and scope.

Check the Sign-In Logs First

Open your Microsoft 365 admin center (Entra ID > Sign-in logs) or Google Workspace audit log. Filter by the affected user for the last seven days, looking for sign-ins from unfamiliar IPs, geographies, or devices. Pay particular attention to successful sign-ins from countries you do not do business in – Russia, Vietnam, Nigeria, and Brazil are common attacker exit nodes. A successful sign-in from an unexpected location before the click means the credential was already compromised and the email was the trigger to log in.

Check Email Forwarding Rules (Attackers Set These Silently)

This is the single most missed step, and the one that turns a 30-minute incident into a six-month nightmare. Attackers who get into Microsoft 365 or Google Workspace immediately set forwarding rules that copy every inbound email – invoices, wire instructions, password resets – to an external address, then delete the original from the sent folder. You will not see it. Your staff will not see it. The attacker reads every email you send for months.

Check forwarding rules now:

• Microsoft 365: In Exchange admin center, check Mail flow settings > forwarding for the affected user. Also run Get-InboxRule in Exchange Online PowerShell to surface client-side rules the GUI hides.
• Google Workspace: In the admin console, check Apps > Gmail > User settings for forwarding and POP/IMAP, and have the user check Settings > Filters and Blocked Addresses in their own Gmail.

If you find a rule you did not create, delete it. Then assume every email sent or received in the window the rule was active was read by the attacker.

Inventory What Was Accessible

Make a one-page list of what the account could see: shared mailboxes, OneDrive/Google Drive, Teams channels, CRM, banking portals. That is your blast radius – everything on it is in scope until you can prove otherwise.

Hours 1-24 – Investigate and Secure

The first 30 minutes were triage. The next 23 hours are systematic investigation – with credential theft, the absence of evidence is not evidence of absence.

Run a Full Endpoint Scan

Reconnect the affected device to an isolated network segment (a guest VLAN works) and run a full EDR scan. Microsoft Defender for Business, SentinelOne, CrowdStrike, or whatever EDR your Memphis managed IT services provider has deployed should give you a clean signal in 20-30 minutes. If you only have legacy antivirus, assume the machine is compromised until forensics clears it – AI-generated polymorphic malware now produces variants that legacy AV detects at 0% in the first 24 hours.

Force Password Reset Across Connected Accounts

The attacker did not just want your email – they wanted credential reuse. Reset passwords on every system the user touches: banking, accounting, payroll, CRM, document management, the WMS or practice management system. Yes, all of them. Yes, today.

Pull Audit Logs for Sensitive Systems

Pull 30 days of audit logs from financial systems, EHR, practice management software, or WMS. Look for unusual exports, after-hours access, and permission changes. This catches the data-theft variant of phishing-driven ransomware attacks, where attackers exfiltrate silently for weeks before encrypting anything.

Notify Your Cyber Insurance Carrier

Most carriers require notification within 24-72 hours, and many policies void coverage if you bring in forensics or pay a ransom before notifying them. Find your policy number, call the breach hotline on the declarations page (not your regular agent), and report a suspected incident under investigation. That single call preserves coverage for forensics, legal counsel, breach notification, and credit monitoring.

The two most expensive mistakes after a phishing incident: powering off the compromised device, and waiting more than 24 hours to call your cyber insurance carrier. Both are reversible only by going back in time.

Days 1-7 – Recovery and Hardening

Once you have contained the incident, the focus shifts to recovery and to closing the holes the attacker found. The hardening this week is the difference between “we got phished once” and “we get phished every quarter.”

Decide on a Full Rebuild vs. Clean Bill of Health

Work with your IT provider to decide whether the endpoint gets reimaged from a known-good baseline or cleared by forensics. The default for a confirmed credential compromise plus malware detection is reimage – the hour of rebuild is cheaper than six months of “is this machine still compromised?” anxiety.

Document Everything for Compliance

Every regulated industry has a documentation requirement after a security incident. HIPAA-covered practices must document under 45 CFR 164.308(a)(6) – our HIPAA compliance services include the templates we use for Memphis healthcare clients. CPA firms update their WISP per IRS Pub 4557 and the FTC Safeguards Rule. Financial advisors document under SEC Regulation S-P. Every Tennessee business documents for the 60-day TIPA breach notification clock, which starts the moment you reasonably suspect unauthorized access.

Client documentation we keep on file: timestamped incident timeline, affected accounts and systems, evidence preserved (sign-in logs, email rules, EDR reports), notifications sent, and remediation completed. The bar: whatever you can hand to an OCR auditor, the state AG, or your insurance adjuster without a follow-up call.

Run Targeted Phishing Simulations

Within a week of the incident, run a phishing simulation for the entire staff – not just the person who clicked. Simulations within 7 days of a real incident produce 3-5x stronger behavioral change than annual training. KnowBe4, Hoxhunt, and Microsoft Attack Simulator make this a one-hour setup.

Tighten the Controls That Failed

Look at why the click became a compromise, not just why the click happened. If MFA was bypassed via push fatigue, switch to number-matching or FIDO2 keys. If the email got through, tighten Microsoft Defender for Office 365 or Google Workspace phishing thresholds. If the user clicked because the email looked exactly like a vendor, add external sender banners on all inbound mail.

How to Prevent This from Happening Again

Crisis response is necessary, but prevention is cheaper by an order of magnitude. The Memphis businesses we work with that have not had a successful phishing breach share five baseline controls – none of them exotic.

• Phishing-resistant MFA on every account. Number-matching, FIDO2 keys, or app-based authenticators – not SMS. SMS-based MFA is actively being bypassed by SIM swapping in Memphis (the March 2026 Stryker incident is a local example).
• EDR/MDR with 24/7 monitoring. Legacy antivirus is no longer sufficient against AI-generated polymorphic malware – see our Memphis cybersecurity services for what EDR coverage looks like in practice. Cyber insurance carriers now require EDR for renewal; MFA failure is the #1 reason for claim denial, lack of EDR is #2.
• External sender banners on inbound email. A bright “EXTERNAL” tag on every email from outside your domain reduces successful spoofing-based phishing by roughly 40% in our Memphis client experience.
• Quarterly phishing simulations with role-based escalation. Not annual training – quarterly. Front-desk and finance roles get monthly simulations because they are the highest-value targets.
• Documented incident response plan, reviewed annually. A one-page plan with phone numbers, escalation order, and the four-step containment sequence above. Required for cyber insurance renewal and by HIPAA, IRS WISP, SEC Reg S-P, and FTC Safeguards. The plan exists or it does not – there is no middle ground at 10:47 a.m. on a Tuesday.

CISA publishes a free Stop Ransomware guide and incident response playbook that pairs with these controls. The FTC’s Data Breach Response: A Guide for Business is the authoritative reference for legal notification requirements. Bookmark both.

Frequently Asked Questions

What should you do immediately when an employee clicks a phishing link?

Disconnect the affected device without powering it off, reset the user’s Microsoft 365 or Google Workspace password from a different device, revoke active sessions and force MFA re-enrollment, and call your IT provider. Tell the employee they are not in trouble – fast reporting is the single biggest factor in clean recovery. Those four steps in the first five minutes prevent the credential from being used and limit the attacker’s blast radius before they can spread.

How do small businesses respond to a phishing attack?

A small business phishing attack response plan follows a 30-minute, 24-hour, 7-day cadence. First 30 minutes: contain (disconnect, reset, revoke sessions) and assess (sign-in logs, forwarding rules). First 24 hours: EDR scan, password resets on connected accounts, audit logs from sensitive systems, cyber insurance notification. First 7 days: reimage endpoints, document for HIPAA/IRS/TIPA, run a staff-wide phishing simulation, tighten the controls that failed. Memphis businesses without an MSP should call one before they need one – response time matters more than vendor selection at 10:47 a.m. on a Tuesday.

Do I have to report a phishing incident in Tennessee?

It depends on what was compromised. TIPA requires notification of affected individuals within 60 days when unencrypted personal information is reasonably believed to have been accessed. If the compromised account had access to client or patient PII, the clock started the moment you suspected the compromise. HIPAA-covered practices face an additional 60-day individual notification requirement and proposed 24-hour business associate reporting under the 2026 Security Rule updates. Document everything, talk to your carrier, and consult counsel before deciding notification is not required.

How much does a phishing attack typically cost a small business?

Approximately $108,000 on average, including incident response, lost productivity, customer notification, regulatory fines, and remediation. AI-driven business email compromise pushes the average per-incident loss above $4.1M when wire fraud succeeds. The five preventive controls above – phishing-resistant MFA, EDR, external sender banners, quarterly simulations, and a documented incident response plan – typically cost a Memphis SMB $80 to $150 per user per month under a managed IT services agreement. Prevention is cheaper than recovery by a factor of 10-100.

Need Help Right Now? Call Netcosa

If you are reading this during an active incident, stop and call us now at (901) 306-7575 . We pick up live, we have walked Memphis dental practices, warehouses, and CPA firms through exactly this scenario, and we know which steps cannot wait until morning. If you are reading to prepare, schedule a free IT assessment and we will build the five-control baseline that prevents the call. The time to plan for a phishing incident is before 10:47 a.m. on a Tuesday.