Has your company’s Exchange server been compromised? Here’s what to do

If your company’s Exchange server has been compromised, isolate it from the internet, check it with Microsoft’s tools, install all the security updates, restore it from a clean backup or rebuild it, and change the account passwords. If it runs Exchange Server 2016 or 2019, which have been out of support since October 14, 2025, also plan to move your email to a supported version.

This article started out, in March 2021, from the largest attack on Exchange servers up to that point. Its lessons still apply today, so we’ve updated it with the steps to take now.

What steps should you take if your Exchange server has been compromised?

1. Isolate the server. Take it off the internet (Outlook on the web and the admin center), but don’t wipe it: keep the logs and a copy of the disks, so that you can find out what happened.
2. Check it. Microsoft publishes free check scripts for Exchange servers in the CSS-Exchange repository on GitHub. Look for unknown files in the website folders (web shells), new administrator accounts, email forwarding rules and scheduled tasks you didn’t create.
3. Install all the security updates, on a version of Exchange that is still supported.
4. Restore or rebuild. The safest route is to restore from a backup taken before the attack, or to reinstall the server from scratch and move the mailboxes over.
5. Change the passwords: those of administrators, service accounts and users, because the attackers may have copied them.
6. Report the incident. If your company falls under NIS2 (GEO 155/2024), a significant incident must be reported to DNSC (the Romanian National Cyber Security Directorate): the directive requires an early warning within 24 hours. If personal data was affected, the GDPR generally requires you to notify ANSPDCP, the Romanian data protection authority, within 72 hours.

Operationally, you can announce a maintenance window and make the changes outside business hours, so that the impact on work is as small as possible.

What happened in March 2021?

In March 2021, according to KrebsOnSecurity, more than 30,000 organizations in the United States had been compromised by a group of Chinese attackers that Microsoft named HAFNIUM. They used four vulnerabilities in Exchange Server to intercept and steal their victims’ email.

Although Microsoft had released updates fixing the four vulnerabilities on March 2, the attacks didn’t stop: they continued on servers that hadn’t been updated yet.

On each compromised server, the attackers left behind a web shell, a login page with a username and password that they could easily use, straight from the browser, to keep access to their victims’ email.

To lower the chances of servers being compromised, Microsoft recommended installing updates as soon as they came out, and it offered extra technical assistance to companies that had already been attacked.

The March 2 updates fixed the vulnerabilities, but they changed nothing on servers that had already been compromised: they couldn’t cut off the attackers’ access.

Microsoft also gave companies free scripts, in the same CSS-Exchange repository: the first one checked whether the server was vulnerable, and those published over the following days also looked for traces of the attack.

Because these were vulnerabilities in a Microsoft product, the attacks couldn’t be stopped without Microsoft’s updates. The simplest fix was to restore a backup from before the attack and to take the server off the internet until the four security updates had been installed.

What should we take away from this whole story?

Backup is sacred. It’s crucial to have a solid backup policy that lets you restore the entire server as quickly as possible.

It’s just as important for IT to keep up with security news and to install updates as soon as possible after they come out. March 2021 wasn’t an isolated case: the ProxyShell vulnerabilities followed in 2021 and ProxyNotShell in 2022, again exploited on Exchange servers that were exposed to the internet and not updated.

A plan written in advance greatly shortens your response to an attack: see what a cyberattack or security incident response plan should include.

What should you do now if your company still runs Exchange Server?

If your company still uses Exchange Server 2016 or 2019, move your email to a supported version: since October 14, 2025, every new vulnerability found in them can stay open.

• Exchange Online, part of Microsoft 365, hands the job of looking after the server over to Microsoft. See how to integrate Microsoft 365 into your business.
• Exchange Server Subscription Edition, sold as a subscription, is the successor for companies that need to keep email on their own server.
• Don’t expose the admin center directly to the internet and, as far as possible, not Outlook on the web either: outside access goes through a VPN or a system that requires authentication before anyone reaches the server.
• Two-step verification for all accounts accessed from outside the office.

You’ll find more about the risks of unsupported software in the article on the problem of end-of-life (EOL) technologies.

If you don’t know what state your company’s email server is in, we can start with a free IT audit. For an incident in progress, contact us right away. And to make sure you can always restore a clean server, see Backup as a Service.