I opened a suspicious attachment but did not click any links or sign in to anything. Am I compromised?

This is one of the most common questions we get, usually asked with a lot more worry than the situation deserves.

Opening a message is not a breach. Replying to one is not a breach. Even opening an attached PDF, on its own, is very unlikely to be a breach on a phone or computer that is up to date. Modern phones in particular open documents in a sandbox, and an attachment that could actually take over a current device requires an exploit far too expensive for the people running bulk quote request scams.

In this style of attack the document is a wrapper. Its whole job is to get you to click through to a page that looks like a Microsoft or Google sign in screen and type your password. So the question that matters is not whether you opened something. It is this: did you enter your email address and password into anything?

If the answer is no, you are almost certainly fine. Block the sender, delete the message, and get on with your day. A full password reset across the company and an afternoon of panic is not a proportionate response, and treating every near miss as a crisis mostly teaches people to stop reporting things, which is the outcome you least want.

If the answer is yes, or you are not sure, then act, and it is still a short list. Change the password on that account right away from a device you trust. Confirm multi-factor authentication is turned on. Check your mailbox rules and forwarding settings, because attackers routinely add a quiet rule that hides or copies certain messages, and that is the step people skip. Then tell whoever handles your IT so they can review sign in activity for logins from unfamiliar places.

One thing is true even when nothing was clicked: replying tells the sender a real person reads that address. Expect more attempts, and expect the next one to reference the earlier exchange to sound familiar. Recognizing it is the defense there, not cleanup.