Hacked business email? Why changing your password isn't enough

Why a password change may not be enough

Some email services keep existing sessions active after a password change. Attackers may also have stolen session tokens, added recovery details or created rules to forward or hide messages.

To secure the account, your IT provider should:

• Revoke active sessions and sign-in tokens.
• Check and remove suspicious forwarding rules and filters.
• Review connected apps and their permissions.
• Remove unauthorised mailbox delegates and sending permissions.
• Check recovery email addresses, phone numbers and authentication methods.
• Review sign-in logs and account activity for signs of further compromise.

Check for hidden access

How to secure a compromised email account

Your IT provider or email administrator should coordinate the recovery process.

• Contain the incident. Temporarily disable or suspend the account if necessary, and revoke active sessions and tokens.
• Reset the password. Use a unique password and communicate it through a trusted channel, not the compromised inbox. Check other accounts if the old password was reused.
• Review account settings. Check rules, forwarding, connected apps, delegates, sending permissions and authentication methods. Remove suspicious access and review app passwords where applicable.
• Investigate the activity. Examine sent, deleted and archived messages, sign-in logs, audit records and security alerts. Look for fraudulent emails, password resets and altered payment instructions.
• Notify affected contacts. Warn recipients if the account sent fraudulent messages. If a payment may have been diverted, contact the bank immediately using a trusted number.
• Restore access securely. Require multifactor authentication (MFA) and confirm that unauthorised access has been removed before the employee resumes normal use.

Frequently Asked Questions