Your Email Filter Was Hacked and What That Means for Your Business

Most business owners never think about the device that screens their company email. It sits in a server closet or in a cloud account, it blocks spam and phishing, and nobody touches it until something breaks. Between mid September and early November 2026, four separate security advisories described outsiders taking full control of exactly that device, or being one short step away from it. Cisco disclosed two flaws in its Secure Email Gateway that attackers were already using. Fortinet disclosed one in its FortiMail product that was being used against customers before a fix existed. Barracuda shipped fixes for a pair of flaws in its Email Security Gateway that, chained together, let a stranger take over the device without ever logging in.

If your IT provider or your own IT person has ever told you that one of these products filters your mail, this post is for you. It is not about how the flaws work. It is about what it means for your business when the thing that reads every email is the thing that got hacked, and what you do in the first few days. The short version is that patching the device is the beginning of the job, not the end of it, and the part that protects your money is a careful look at your invoice and payment email.

Why the Email Filter Is the Worst Device to Lose

An email gateway, also called an email filter or a secure email gateway, is a device or service that inspects every message coming into and going out of your company before it reaches anyone's inbox. It decides what is spam, what carries a dangerous attachment, and what gets delivered. To do that job it has to read everything. That includes the invoice threads with your clients, the payment approvals between your controller and your bank, the contracts going out for signature, and the password reset emails your staff receive.

That is exactly why attackers want it. Barracuda's advisory describes what an outsider with full control of the filter can do in plain terms: quietly read mail, tamper with delivery rules, and use the box as a foothold into the rest of the network. Cisco's September advisory tells customers to assume the attacker could read mail passing through the device and to plan the response around that. The FortiMail attackers went further and installed hidden software that loads into every program running on the appliance, including the programs that handle mail.

Now connect that to the problem we are called about more than any other. Business email compromise, usually shortened to BEC, is a scam in which a criminal gets inside a company's email, or impersonates it convincingly, and uses that position to send fake invoices or change where payments go. A compromised filter is a bigger prize than one stolen mailbox, because it sits in front of all of them. Someone who controls it can watch an invoice conversation develop for weeks, learn who approves payments and how your team writes, and then step in at the right moment with new bank details that look completely routine.

Picture a 25-person distribution company in Allen whose filter was exposed for a month before anyone checked it. The spam kept getting blocked, so nobody noticed anything wrong. The first sign of trouble is a call from a long-time customer asking why the payment they sent to your new account has not been credited. That is the business risk here. The loss does not show up on the device. It shows up in your receivables, your client relationships, and possibly your insurance claim.

The First Phone Calls

When you learn that your filter runs on one of the affected products, the order of your calls matters more than how fast you make them.

The first call goes to whoever manages the device, whether that is an outside IT provider or your own staff. Ask three things. Which product and version do we run? Has anyone run the vendor's compromise check? And please, before you upgrade or rebuild anything, save a copy of the device and its logs. That last request is not paranoia. Cisco warns that upgrading one of its virtual appliances destroys the forensic data and logs on it, and Fortinet tells customers to capture forensic images before they rebuild. Digital forensics is the careful copying and examination of a device so you can later prove what happened, much like a crash investigator photographs the scene before the cars are towed away. If the device is wiped first, you may never be able to tell your clients, your insurer, or a regulator whether anyone read their information.

The second call goes to a team that handles email compromise for a living. If the vendor check finds anything, or if nobody can say whether a check was run, you want digital forensics specialists preserving the evidence and a business email compromise response team working out whether any payments were redirected. Those are two different jobs that need to happen at the same time.

The third call, if any payment instructions changed during the period the device was exposed, goes to your bank. Banks can sometimes recall a wire or hold a transfer, but only if they hear about it quickly. If you are not sure, start the invoice review described below the same day.

Why Installing the Update Does Not Prove Nobody Got In

This is the part most businesses get wrong, and it is the part your IT ticket will not tell you. A fix closes the hole. It does not remove anyone who already climbed through it.

Fortinet says so directly. Applying its workaround does nothing to remove hidden software that is already on the device. In the FortiMail case, that software was built to load into every program on the appliance, which is how a long-term eavesdropper behaves, not a vandal. Cisco warns that because a successful attack gives the outsider complete control, evidence of the break-in may be removed or hidden. A clean result from the built-in check is good news, but Cisco itself says it is not a clean bill of health. An attacker with full control of a device can edit its logs as easily as your IT team can read them.

Barracuda's own history makes the point even more sharply. In 2023, a group of attackers used a flaw in the same Barracuda product for months before anyone noticed, planted hidden back doors, and dug in deeply enough that Barracuda told affected customers to physically replace their appliances rather than trust a patch. The November 2026 advisory says nothing ties the new flaws to that group, and as of the advisory no attacks using them had been reported. It still notes that persistence on these devices has survived a simple firmware update before.

There is a second trap in the Cisco timeline. The September flaw and the October flaw sit in different parts of the product. One version Cisco shipped after the September scramble does not fix the October flaw, so a business that patched in September and moved on may still be exposed. "We patched it" can be true and still not be the whole answer.

We have written before about the general version of this problem in we installed the security update, were we already hacked. The email filter is the sharpest example of it, because the device that might be lying to you is the same device that handles your money conversations.

Change Every Password and Key the Filter Knew

An email filter does not work alone. To do its job it holds logins and keys for other systems, and an attacker with full control of the device can copy them. If those are not changed, replacing the box does not close the door. The attacker simply walks back in with a key they already have.

The advisories name what to change. The FortiMail and Cisco guidance both list the directory account, which is the login the filter uses to look up which employees exist in your company. They also list the relay credentials, which are the login the filter uses to hand mail on to your mail server, along with administrator passwords and any connection keys used to link the filter to other software. Cisco's guidance adds the encryption keys and certificates on the device, which are the digital credentials that prove mail from your company really came from you. Cisco's October advisory sums it up in one instruction: treat every credential, certificate, and integration secret stored on the gateway as burned. For companies that run more than one filter linked together, Cisco notes the keys those devices use to trust each other may have been exposed too, so every linked device may need to be restored.

In business terms, this is a few hours of careful work that prevents a second incident six weeks from now. It also tends to fall on whoever is already overloaded. If your company has one internal IT person who runs the filter along with everything else, co-managed IT, where an outside team works alongside your own IT person rather than replacing them, is one way to get the rotation and the review done this week instead of next quarter.

It is also worth asking how sure you are about which filtering devices you own. Barracuda's advisory makes the point that network devices often fall outside the coverage of the tools meant to find weak spots. If nobody can produce a list of your email and network appliances with their versions, vulnerability scanning that actually reaches those devices is how that list gets built, and it is far cheaper to find a forgotten device now than during an incident.

Check the Invoice Threads, Not Just the Device

The device work protects the network. This step protects your money, and it is the one that most often gets skipped because it is not a technical task.

Start by agreeing on the exposure window. That is the period from when your filter first ran an affected version to the day it was fixed and checked. None of the four advisories says when attacks began. Fortinet has not said, and Cisco has not said how long attackers were using either flaw before it noticed. So assume the window is longer than you would like, and set it generously.

Then have someone in accounting, not IT, read through the email in that window with one question in mind: did anything about money change? Look for any message asking to update bank details, any invoice that went out with different payment instructions than the last one, any client who wrote to say they had already paid, and any reply you expected that never arrived. A missing reply matters because one of the things a filter attacker can change is where mail is delivered. Ask your IT provider to confirm that no forwarding or redirect rules were added to the filter or to individual mailboxes during the window.

If you find something, the people most at risk may be your clients rather than you. A fake invoice sent from your real address, or one that looks exactly like yours, will be trusted. Our guide on what to tell clients when a fraudulent invoice leaves your mailbox covers how to warn them without causing a panic, and our New York vendor email fraud case study shows how one real vendor fraud was worked through to a resolution.

Questions to Ask Your IT Provider This Week

You do not need to understand the technology. You need questions with specific answers, and to notice when the answers are vague.

Ask which email filter you use and which version it is running today. Ask whether the vendor's compromise check was run before the device was updated, and what it reported. Ask whether the filter's logs are copied somewhere off the device, because Cisco's own guidance points out that logs sitting on a compromised box belong to the attacker, while records sent elsewhere earlier are far harder to erase. Ask whether the filter's management screen can be reached from the internet, since both Fortinet and Barracuda point to locking that screen down as one of the most useful protections. Ask whether the directory account, relay logins, and keys were changed, and on what date. And ask who reviewed the filter's outbound connections, because an email filter has a predictable pattern of who it talks to, and anything outside that pattern deserves a hard look.

A good answer names a product, a version, a date, and a result. A poor answer sounds like "we are on it" or "it auto-updates." If you are not getting specific answers, that is not a reason to panic, but it is a reason to bring in a second set of eyes. Longer term, an email security review looks at whether your filter, mailboxes, and payment approval habits are set up so that one compromised device cannot quietly redirect a payment.

Getting Help the Same Day in McKinney and North Texas

Innovation Network Design is based in McKinney and works with businesses across Collin County, Plano, Frisco, and the wider DFW area. When an email filter may have been compromised, we start the way this post describes: preserve the evidence, confirm whether anyone got in, change what the device knew, and walk your accounting team through the invoice review so a redirected payment is caught while the bank can still act.

If your filter runs on one of these products and nobody can tell you whether it was checked, call us at 512-518-4408 or contact us online. If you would rather start with a broader look at where your email and payment process is exposed, request a security assessment.

Frequently Asked Questions

Does a hacked email filter mean our employee mailboxes were hacked too?

Not necessarily, but you cannot assume they were not. The filter sits in front of your mailboxes and reads mail as it passes through, so an attacker who controls it can see messages without logging in to any mailbox. It may also hold logins that reach your mail system, which is why changing those logins is part of the response.

Our IT provider installed the security update. Are we safe now?

The update closes the flaw, but it does not remove an attacker who got in before it was installed. Fortinet says its workaround does not remove hidden software already on the device, and Cisco says attackers may hide the evidence of their break-in. Ask whether the vendor's compromise check was run, whether the logins the filter held were changed, and whether anyone reviewed your payment email from the exposure window.

How far back should we review our invoices and payment emails?

Go back to the date your filter first ran an affected version, not just the date the flaw was announced. None of the vendors said when attacks began, so a generous window is safer than a narrow one. Focus the review on changed bank details, invoices with new payment instructions, and clients saying they already paid.

Should we replace the email filter appliance entirely?

Only if the evidence points that way. Cisco recommends rebuilding a compromised virtual appliance with new credentials rather than cleaning it in place, and in 2023 Barracuda told some customers to physically replace affected devices. Preserve a forensic copy first, let the investigation decide, and change every password and key the old device held either way.