One Click from Catastrophe

Before the Incident | One Great Night, One Bad Workday

For Jodi Plett, founder of FlexKeeper, a Florida-based accounting firm, the day started like any other—though it required an extra dose of coffee. The previous night had been a whirlwind of excitement, with her favorite team clinching the championship hockey title, and the celebrations stretching into the early morning hours. Despite her fatigue, Plett knew there was no time to rest. Her clients were counting on her, and she wasn’t about to let them down.

‍What seemed like a small decision, however, was about to escalate into a significant misstep.

‍

A Threat Emerges | When Everything Falls Apart 

Hours passed, and nothing seemed out of the ordinary. Until it all started falling apart. Near the end of the workday, Plett’s email suddenly froze. Then, her computer locked her out. That’s when the panic set in. 

‍Plett knew this wasn’t a glitch—something malicious was happening. A hacker had snuck into her company’s most vital environment—Microsoft 365. As a platform that stores sensitive client data, it’s become the backbone for businesses like FlexKeeper. That’s also why it’s become a lucrative target for cybercriminals. 

‍For Plett, everything from her clients’ financial records was at risk. She was at ground zero, sitting with the gut-wrenching realization she might’ve been the one to open the gates for the enemy. FlexKeeper’s future was now on the line.

The value Huntress brings to the table for small businesses—at a reasonable price—is huge. You give us the same visibility and reassurance that big businesses have. At the end of the day, everyone’s a target, and attackers are out there hunting for any data they can find and exploit. For us, having that level of capability is a massive win. - Dave Bloom, Founder | Trumbull Tech

‍

The Alert | Huntress Signals Trouble  

Dave Bloom, founder of Trumbull Tech—FlexKeeper’s trusted MSP—was driving his kids to swim practice when he received an alert from Huntress. Thanks to Huntress Managed Identity Threat Detection and Response (formerly MDR for Microsoft 365), Bloom and his team could

rely on constant, proactive monitoring to ensure their clients’ systems stayed secure. “ITDR lets us protect our clients at scale," Bloom explains. "Our engineers can’t be everywhere at once, but with ITDR actively monitoring tenants, we’re confident our clients maintain a strong and efficient security baseline.”

‍The alert flagged a suspicious VPN login from Toronto, an anomaly that immediately raised red flags. While Plett might be a big hockey fan, Bloom knew she wasn’t anywhere near Canada. This was an intruder in her network, poking around where they didn’t belong. Unfortunately for

them, they had just run into a brick wall.

‍

Taking Action | Locking Down the Threat

Bloom wouldn’t return to his home until later in the evening, but by the time he began his investigation, Huntress’s automated response had already handled the situation. It promptly shut down the intruder, rotated passwords, and locked the threat out of the system. “Without Huntress Managed ITDR, we wouldn’t have had visibility into the threat or the unauthorized access, and the threat actor could’ve maintained access to the data and tenant indefinitely,” he says. 

‍How It All Began | It’s Hard to Catch a Phish When You’re Fatigued 

As the dust settled, Plett couldn’t shake the nagging sense of how it all started. It began innocently enough when a seemingly harmless DocuSign email hit her inbox earlier that day. Having spent years in IT, she knew the drill. Just because it looked legit, didn’t mean it was. Fatigue can cloud even the sharpest judgment, so in a momentary lapse, she clicked. In that instant, she unwittingly provided her personal credentials. “I always preach to my team, ‘Don’t click on that!’ And then, guess what I did?” she recalls with a mix of humor and disbelief.

‍Only in retrospect did Plett realize she had been caught in a phishing attack. Hackers had exploited her one moment of vulnerability to gain access to FlexKeeper’s most sensitive data.