We have received a phishing email trying to get money from us, this email came from an account that was spelled closely to our work email but not quite the same.
I have looked up the domain and found it was apparently set up yesterday.
My true concern is that the e-mail was RE:<SUBJECT> where the subject and recipients were all part of a real internal email chain. The email was not really a reply but the subject was correct and was from an email sent hours earlier.
What sort of compromise in my (G-suite) system would allow someone to be able to read subjects but not have full access to the email itself?
Other then full password re-sets should I be concerned about additional holes?