What NOT to do

• Don’t assume it’s fixed after changing the password.

• Don’t ignore forwarding rules or app permissions.

• Don’t delay internal communication. Silence increases risk to others.

Containment and remediation

Once immediate access is removed:

• Reset passwords for any linked or reused credentials

• Remove unauthorised rules, forwarding, and app access

• Review MFA and conditional access policies

• Monitor login activity closely for several days

• Scan endpoints used by the affected user

Do you need to tell anyone?

You may need to notify:

Whether external reporting is required depends on the data involved and confirmed exposure.

Preventing future email compromises

Most email hacks exploit:

• Weak or reused passwords

• Missing MFA

• Poor visibility into account activity

Key preventative measures include:

• MFA for all email accounts

• Conditional access policies

• Regular mailbox and sign-in reviews

• User awareness around phishing

• Monitoring for suspicious rules and app access

Signs the attacker may still have access

After remediation, watch for:

• Rules or forwarding reappearing

• Repeated MFA prompts

• Unexpected password resets

• Login attempts from unfamiliar locations

• Continued reports of suspicious emails

Any of these should be treated as an active incident.

People Also Ask

How do I know if my email has been hacked?

Common signs of a hacked email account include password reset emails you did not request, messages sent from your account that you do not recognise, login alerts from unknown locations, missing emails, changed settings, unusual forwarding rules or contacts receiving suspicious messages from you.

What should I do first if my email has been hacked?

The first step is to regain control of the account and change the password using a strong, unique password. You should then enable multi-factor authentication, sign out of all devices, check account recovery details, review forwarding rules and look for suspicious connected apps or active sessions.

Should I tell my contacts if my email has been hacked?

Yes, if suspicious emails may have been sent from your account. Warn contacts not to click links, open attachments, reply to unusual requests or send money or information based on messages that appear to come from you. This is especially important for business email accounts.

Can a hacked email account lead to a data breach?

Yes. A hacked email account can lead to a data breach if personal data, customer information, employee records, financial information or sensitive business data has been accessed, disclosed or stolen. Businesses should assess what information may have been exposed and whether reporting obligations apply.

Can IT Desk help secure a hacked business email account?

Yes. IT Desk can help businesses secure hacked email accounts by reviewing Microsoft 365 sign-ins, resetting access, checking forwarding rules, improving MFA, reviewing security settings and helping reduce the risk of future phishing or account compromise.

How can I prevent my email from being hacked again?

You can reduce the risk by using strong unique passwords, enabling multi-factor authentication, keeping devices updated, avoiding suspicious links and attachments, reviewing account recovery details, using phishing protection and regularly checking account activity and forwarding rules.