A staff member clicked a phishing link. Now what?
The first hour decides whether a click becomes an incident. A checklist for the person who clicked and for the technology team, written for school districts.
If you clicked: for staff
- Tell your technology team right away, even if nothing seemed to happen. Speed matters more than embarrassment.
- Say exactly what you did: opened it, clicked a link, opened an attachment, or typed a password.
- Report the email with the report button. Do not delete or forward it.
- If you typed a password, change it only on a page you go to yourself, never through a link in an email, or wait for your technology team to reset it.
- If money or bank details were involved, tell the business office immediately. A payment can sometimes be stopped if the bank is called quickly.
The first hour: for the technology team
- Reset the password and sign the account out of every session.
- Check the sign-in methods (multi-factor authentication) on the account for anything newly added.
- Look for new mailbox rules or forwarding. Attackers use them to keep reading mail quietly after a password change.
- Review recent sign-ins for unfamiliar locations, devices or times.
- Search every mailbox for the same message and remove it. One report rarely means one recipient.
- Block the sender and the link’s domain.
- If an attachment was opened, check that device for anything that ran, and isolate it if in doubt.
- Write down what happened and when. Your insurer will ask for it.
When money is involved
Business email compromise, where a criminal impersonates a vendor or a colleague to redirect a payment, is the costliest version of a click. In June 2025, K12 SIX reported that Sabine Parish School Board in Louisiana sent $251,972 to a fraudulent account instead of the intended vendor.1
The defense is a rule, not software: never change payment or bank details because of an email. Confirm every change by phone, using a number you already have on file, not one in the message.
After the incident
- A short lesson for the person who clicked, about that specific trick. No blame.
- A brief note to staff that the message is going around, so anyone who received it knows to report it.
- A look back: how long did it take from the click to the first report, and from the report to removal?
Where BlueHook fits
BlueHook covers the email side of this checklist. Staff report with one click, an analyst investigates, and the message is found and removed in every mailbox it reached. For the device side, Guardian watches every endpoint around the clock and can isolate a machine while an attack is still happening.
Questions
Common questions
Should the person who clicked be disciplined?
No. Treat a quick report as the right outcome. Discipline teaches the next person to hide a click, and hidden clicks are the dangerous ones.
Do we have to report a phishing incident to anyone?
It depends on what was exposed and on your state’s rules. If student or staff personal information may have been accessed, involve your district’s counsel and your insurer early.
How do we find everyone who received the same email?
Microsoft 365 and Google Workspace both let an administrator search every mailbox. BlueHook does the search and removal for you, starting from a single report.
Get started
Tell us what you are being asked to prove.
An insurance renewal, a state review, a board question. We will tell you which program answers it, or that none of them do. Straight answer, fixed quote, from the engineer who would do the work.
Reply within one business day. No sales sequence, no mailing list.