Statement on Email Security Incident – 30th May 2025

11 Jun 2025

Statement on Email Security Incident – 30th May 2025

On Friday 30th May 2025, around 14:30, the Skate Molton CIC email account belonging to James Swanson was compromised, resulting in scam emails being sent from james@skatemolton.co.uk to multiple contacts in James’ address book.

The emails contained a malicious link and were part of a phishing attempt designed to trick recipients into clicking a harmful URL.

How We Responded

Skate Molton CIC was quickly alerted to the issue by several of our contacts via Facebook Messenger and telephone within 15 minutes of the scam emails being sent.

At 14:45, immediate action was taken to secure the compromised account:


- A forced sign-out was issued on all devices connected to the account via Microsoft 365.

- The account password was changed immediately.

- A detailed check revealed hidden email rules, which were promptly removed.

- A mail flow report was run via Microsoft 365 to identify which contacts had received the scam emails.

By 15:23, Skate Molton CIC sent an urgent notification from info@skatemolton.co.uk to all known recipients of the scam email with the following message:

Hi All,

We’d like to send a huge apology from us at Skate Molton CIC as it seems James’ account has been hacked.

An email has been circulated from james@skatemolton.co.uk to many contacts with a malicious link within it.

PLEASE DO NOT OPEN THIS LINK AND DELETE THE EMAIL.

James’ account has now been secured, and we are starting an investigation into how they gained access and the extent of the damage.

Skate Molton CIC will release a statement on the impact in due time.

Thank you and again, apologies for this.

Investigation Findings

Following our internal investigation:


- No evidence was found of any third-party logging into James’ account.

- It was determined that a malicious script was used to send out the scam emails, rather than direct access to the inbox.

- James’ account did not hold administrative privileges and had no access to sensitive internal systems or additional data.

- The likely cause was a cookie stealer or phishing login page from a previously received scam email.

Further Action Taken

To strengthen security moving forward:


- All staff and volunteers at Skate Molton CIC have undergone refresher training on email and computer safety.

- Security checks and protocols have been reviewed and updated across all accounts.

- Microsoft 365 security settings and alerts have been enhanced to better detect suspicious activity.

How You Can Stay Safe Online

We’d like to remind everyone of some simple ways to protect your digital accounts:


- Never click on suspicious links or open unexpected attachments.

- Always double-check sender addresses, even if the name seems familiar.

- Be cautious of login pages sent via email — access services by typing the official web address into your browser.

- Regularly update your passwords and use multi-factor authentication (MFA) where possible.

- Keep up-to-date antivirus software running and scan your system frequently.

- If unsure, contact the sender via another trusted method to verify the email.

We sincerely apologise to all our contacts for any inconvenience caused and thank those who helped us act quickly to resolve this issue.

Skate Molton CIC remains committed to the safety and privacy of our community.

For any further questions or concerns, please contact us at info@skatemolton.co.uk.

Published: 11th June 2025