Email Compromise Incident Report Form
Report a suspected or confirmed compromise of an email account so security or IT can review the incident and take follow-up action.
Incident Details
Compromised Email Address
*
example@example.com
Incident Status
*
Suspected compromise
Confirmed unauthorized access
Phishing clicked
Mailbox forwarding changed
Unknown
Date/Time Discovered
*
 -
Month
 -
Day
Year
2 digit month, 2 digit day, 4 digit year
Date
Hour Minutes
AM
PM
AM/PM Option
Reporter Information
Full Name
*
First Name
Middle Name
Last Name
Role or Department
*
Callback Contact Method (Work Email or Phone)
*
Compromise Summary
Brief description of what happened
*
How the compromise may have occurred
*
Phishing email
Malicious attachment
Credential reuse
Suspicious login
Forwarding rule change
Unknown
Other
Any data or systems may have been affected
*
Yes
No
Unsure
Containment and Follow-up
Actions already taken
*
Password reset
Account locked
MFA enabled
Suspicious messages deleted
IT/security team notified
Mailbox rules reviewed
Other
Urgency / Priority
*
Low
Medium
High
Critical
Submit Incident Report
Should be Empty: