Someone on our team entered their password into a fake login page. What do we do right now?

First, make it safe for people to tell you. The single biggest factor in how badly this goes is how fast someone speaks up, and blame is the thing that makes people wait until tomorrow. Assume it will happen to a good employee eventually, because it does.

Then work through it in order. Change the password on that account immediately, from a device you trust rather than the one that may be affected. Confirm multi-factor authentication is turned on for the account, and if it already was, sign out all active sessions so a stolen session token cannot be reused.

Next, check mailbox rules and forwarding settings. This is the step people skip and the one that matters most. A very common move after a mailbox is taken over is to add a quiet rule that forwards or hides messages containing words like invoice, payment, or bank. That rule is how a credential theft turns into a fraudulent payment weeks later, long after everyone assumed the incident was over.

After that, review recent sign in activity for logins from unfamiliar locations or devices, and check whether anything was sent from the account that the person does not recognize. If mail did go out to customers or vendors, tell them directly rather than hoping nobody noticed, because the follow up scam usually targets exactly those contacts.

Finally, think about what money could move. If the account belongs to someone who handles payments, verify that no banking or payment details were changed anywhere, and let your bank know if anything looks off.

If you have a managed IT provider, call them at the start of this rather than the end. Most of these steps are faster from the administrator side, and reviewing sign in logs across the whole tenant tells you whether one person was targeted or everybody was.