Reply to all, including BCC on an email I (or one of my users) sent

Cyber Security & Hacking
1

Hi All,

Once of my customers had one of their O365 accounts compromised yesterday.

The bad actor sent emails to about 7000 contacts with a phishing link in blocks of about 120 addressed BCC’d per email.

Account is secured and the deleted emails have now been recovered but I wanted to send a blanket email out to all of the people who received the phishing email to apologise and tell them to just delete it.

Problem is, although I can see all of the BCC address’ (because I am on the customers account and I can see them in the sent items) if I reply or reply all then I only get the customers address in the to box, not any of the BCC address’.

Anyone got a clever way of dealing with this?

2

Stand down, I have a solution.

Seconds after I posed this MS actually rang me back and advised me that if you reply all in OWA that it will include all the BCC’s address. If you do it in Outlook it does not.

The really ironic bit here being that I was only using Outlook because yesterday they told me “move to a folder” from deleted for multiple items only works properly in outlook…

Microsoft - Consistently inconsistent.
(new tag line for them there)

3

Doesn’t sound fun :frowning:
Good luck!