One Click from Catastrophe

Before the Incident | One Great Night, One Bad Workday

For Jodi Plett, founder of FlexKeeper, a Florida-based accounting firm, the day started like any other—though it required an extra dose of coffee. The previous night had been a whirlwind of excitement, with her favorite team clinching the championship hockey title, and the celebrations stretching into the early morning hours. Despite her fatigue, Plett knew there was no time to rest. Her clients were counting on her, and she wasn’t about to let them down.

‍What seemed like a small decision, however, was about to escalate into a significant misstep.

‍

A Threat Emerges | When Everything Falls Apart 

Hours passed, and nothing seemed out of the ordinary. Until it all started falling apart. Near the end of the workday, Plett’s email suddenly froze. Then, her computer locked her out. That’s when the panic set in. 

‍Plett knew this wasn’t a glitch—something malicious was happening. A hacker had snuck into her company’s most vital environment—Microsoft 365. As a platform that stores sensitive client data, it’s become the backbone for businesses like FlexKeeper. That’s also why it’s become a lucrative target for cybercriminals. 

‍For Plett, everything from her clients’ financial records was at risk. She was at ground zero, sitting with the gut-wrenching realization she might’ve been the one to open the gates for the enemy. FlexKeeper’s future was now on the line.

The value Huntress brings to the table for small businesses—at a reasonable price—is huge. You give us the same visibility and reassurance that big businesses have. At the end of the day, everyone’s a target, and attackers are out there hunting for any data they can find and exploit. For us, having that level of capability is a massive win. - Dave Bloom, Founder | Trumbull Tech

‍

The Alert | Huntress Signals Trouble  

Dave Bloom, founder of Trumbull Tech—FlexKeeper’s trusted MSP—was driving his kids to swim practice when he received an alert from Huntress. Thanks to Huntress Managed Identity Threat Detection and Response (formerly MDR for Microsoft 365), Bloom and his team could

rely on constant, proactive monitoring to ensure their clients’ systems stayed secure. “ITDR lets us protect our clients at scale," Bloom explains. "Our engineers can’t be everywhere at once, but with ITDR actively monitoring tenants, we’re confident our clients maintain a strong and efficient security baseline.”

‍The alert flagged a suspicious VPN login from Toronto, an anomaly that immediately raised red flags. While Plett might be a big hockey fan, Bloom knew she wasn’t anywhere near Canada. This was an intruder in her network, poking around where they didn’t belong. Unfortunately for

them, they had just run into a brick wall.

‍

Taking Action | Locking Down the Threat

Bloom wouldn’t return to his home until later in the evening, but by the time he began his investigation, Huntress’s automated response had already handled the situation. It promptly shut down the intruder, rotated passwords, and locked the threat out of the system. “Without Huntress Managed ITDR, we wouldn’t have had visibility into the threat or the unauthorized access, and the threat actor could’ve maintained access to the data and tenant indefinitely,” he says. 

‍How It All Began | It’s Hard to Catch a Phish When You’re Fatigued 

As the dust settled, Plett couldn’t shake the nagging sense of how it all started. It began innocently enough when a seemingly harmless DocuSign email hit her inbox earlier that day. Having spent years in IT, she knew the drill. Just because it looked legit, didn’t mean it was. Fatigue can cloud even the sharpest judgment, so in a momentary lapse, she clicked. In that instant, she unwittingly provided her personal credentials. “I always preach to my team, ‘Don’t click on that!’ And then, guess what I did?” she recalls with a mix of humor and disbelief.

‍Only in retrospect did Plett realize she had been caught in a phishing attack. Hackers had exploited her one moment of vulnerability to gain access to FlexKeeper’s most sensitive data.    

When choosing vendors in any industry, you should rely on companies like FlexKeeper that aren’t only transparent but also take the security of your information seriously. -Dave Bloom, Founder | Trumbull Tech

‍

‍

Aftermath | An MSP’s Dedication Doesn’t Stop 

Huntress had shut down the threat within 15 minutes, preventing disaster for Plett and FlexKeeper. But the story didn’t end there. And neither did Bloom’s commitment to his client. 

He dug deep, combing through FlexKeeper’s Microsoft 365 audit logs to double-check that no sensitive data had been exfiltrated. “This incident could’ve been devastating for Jodi, given the sensitive financial data she handles and maintains for her clients,” explains Bloom. Log by log, he ensured every file was intact, never wavering from protecting FlexKeeper’s hard-earned reputation.

‍

Reflecting on the Incident | Dodging a Bullet 

It wasn’t until a full forensic audit was completed over the next week that the gravity of the situation hit Bloom. Fortunately, the hackers hadn’t accessed any sensitive data, but it was close. If Huntress Managed ITDR wasn’t there for Trumbull Tech, the breach could’ve gone unnoticed for hours, maybe even days. If that were the case, the consequences would’ve been catastrophic to FlexKeeper.

 “I trust Dave with everything IT,” Plett says, relieved and grateful. After all, Bloom and Trumbull Tech—with Huntress by their side—had saved her business in real-time with swift, surgical precision.

‍

Turning Crisis into Teaching | Jodi’s Next Move

Plett now had a choice to make. She could keep this cyberattack quiet or leverage it to educate others. Staying true to her candid style, she shared her story with her own clients, which even led to new referrals for Trumbull Tech. 

‍“I nearly compromised my company. I would’ve had to inform my clients and my insurance company, but I didn’t have to do any of that because of Dave and Huntress. I’m so impressed,” she says. What could’ve ended FlexKeeper became a teachable moment, empowering Plett to help other businesses protect themselves from the threats targeting them.

‍

Lessons Learned | How to Thrive Amid Cyber Threats 

Cyberattacks are no longer a matter of “if,” but “when,” yet Bloom notes that many businesses are still reluctant to invest in cybersecurity. He hopes Plett’s story can help them see things differently. “For a modest amount of money, Jodi has incredible protection. When choosing vendors in any industry, you should rely on companies like FlexKeeper that aren’t only transparent but also take the security of your information seriously.”

‍Plett’s innocent mistake could’ve cost her everything, but with Huntress and Trumbull Tech in her corner, she managed to escape a cyberattack that could’ve destroyed her livelihood. Her near-miss reveals one important lesson: while small and medium-sized businesses with limited resources are now prime targets, top-tier cybersecurity isn’t out of reach. With the right partners and tools, they can fight back—and win.

‍

‍