messed up on my first real incident response... (HELP)

User clicked a phishing email and emails went out to all of her contacts. We reset her password, reset her MFA, and the user received a new computer. This all happened Friday.

​

User called the helpdesk (I sometimes pick those calls up) stating that none of her emails are appearing. After a quick search I discovered all emails were being forwarded to her RSS feed and therefore she was not notified. Thinking this was just some weird quirk with …

called computer contacts cybersecurity email emails helpdesk incident incident response mfa password phishing reset response