28 Oct Compromised Email Account
When someone gets into a business email account, changing the password should happen immediately. Once that is done, the account still needs a full check because other forms of access may remain. During the time they had access, the attacker may have created a forwarding rule, approved a connected app, added a sign-in method, or granted access to another account. They may also have a browser or email app that is still signed in. Email deserves particular care because it is connected to so many other services. Password-reset messages for accounting software, cloud storage, social media, and other business systems often arrive by email. Someone who can still read the inbox may be able to reach those accounts too.
Why a New Password May Not Remove Every Form of Access
Changing a password does not always remove an attacker immediately. Existing sessions, connected applications, forwarding rules, delegates, and recovery methods may remain active. Your IT administrator should revoke active sessions and review the account for any unauthorised changes.
An Existing Session May Still Work
An attacker may still have a valid session or stolen login token after the password is changed. Your IT administrator should revoke active sessions and tokens or sign the account out of all devices. If malware is suspected, check the affected computer before signing in again.
Forwarding Rules Can Keep Sending Out Your Email
Attackers can create forwarding rules that secretly send emails to another address or hide security warnings and replies. Check all forwarding settings, inbox rules, and filters, including hidden rules, and remove anything that is not authorised.
A Connected App May Have Permission to Read the Mailbox
Connected applications can have permission to access email without using the account password. Review all applications connected to the account and remove anything your business does not recognise or approve.
Someone Else May Have Mailbox Permissions
Delegates can access or send from a mailbox using their own accounts, so changing the mailbox owner’s password may not remove their access. Check all mailbox permissions and remove any users or groups that should not have access.
Check Recovery and Sign-In Methods
Review all phone numbers, recovery email addresses, authenticator apps, passkeys, security keys, and registered devices. Remove anything the employee or administrator does not recognise.
How to Secure a Compromised Email Account
Some of the settings involved are only visible through the business administration tools. Contact your IT provider or email administrator rather than asking the employee to handle the entire cleanup from their inbox.
- Disable or suspend the account and revoke active sessions to remove the attacker’s access.
- Change the password to a strong, unique password and update any other accounts where the old password was reused.
- Review mailbox and account settings for suspicious forwarding rules, filters, delegates, connected apps, recovery methods, and devices.
- Investigate what happened by checking email folders, sign-in activity, audit records, email traces, and security alerts.
- Contact affected recipients if fraudulent emails, invoices, payment requests, or password-reset messages were sent from the account.
- Secure the account before restoring access by removing unauthorised settings and enabling MFA, passkeys, or security keys where supported.
How to Reduce the Risk of Another Compromise
Ask your IT provider to block automatic forwarding to outside addresses unless your business has a reason to allow it. Microsoft 365 and Google Workspace also provide controls for limiting which third-party applications employees can connect. Require MFA for every email account, especially administrators and employees who handle payments or sensitive information. Use passkeys or physical security keys where the platform supports them. Employees should report unexpected MFA prompts, unfamiliar login alerts, mailbox changes, and messages sent from their account that they do not recognise. Report these signs as soon as they appear so your IT provider can check the account before more email is sent or deleted.
If you think someone still has access to your business email, contact your IT provider immediately. If you do not have an IT provider, you can always reach out to us and we’ll help you.
Robert Brown
28/10/2026
Related Articles:
Office Move Without IT Disruption
How often should a small business check its IT?