Your business email was hacked, and the password change is only the first step.

Before you change anything

1. If the computer you normally use for mail is itself in doubt, work from a different one.
2. Take screenshots of your Rules, your Forwarding setting, Sent Items, Deleted Items, and the recent sign-in list. Once you change things, that record is gone. The page on keeping evidence before you clean up covers this in more detail.
3. Tell whoever administers your email. Several steps below need an administrator.
4. Don’t send the new password by email. Microsoft’s guide says the attacker could have access to the mailbox at this point.

Microsoft 365: the order Microsoft lists

If the mailbox can no longer send mail, Microsoft’s notice is a bounce reading “550 5.1.8 Access denied, bad outbound sender.” That means the account was blocked for sending too much. An administrator removes the block from the Restricted entities page, and only after the steps above are done. Microsoft says to regain control of the account first.

1. Disable the account while you investigate. Microsoft calls this preferred and highly recommended. If you can’t, reset the password to one that is long, unique, and not one of the last five used.
2. Revoke active sessions. Microsoft lists this as its own step because it ends access that is already signed in with the stolen credentials.
3. Review the sign-in methods registered to the user, and remove any phone, device, or method you didn’t add.
4. Review the apps that have been given permission to the account, and remove any that shouldn’t have it.
5. Review administrative roles assigned to the user.
6. Review forwarding and Inbox rules, hidden rules included. An administrator can list them with Get-InboxRule and the -IncludeHidden option, and can read the forwarding fields on the mailbox with Get-Mailbox.
7. Replace app passwords. Microsoft says they aren’t revoked when the password is reset.
8. Read the sign-in and audit logs from before the first sign of trouble until now: IP address, location, time, and whether the sign-in succeeded.

Google Workspace and Gmail

1. If you’re locked out, use Google’s account recovery page.
2. Open Security, review Recent security events, then Your devices and Manage devices. Sign out anything you don’t recognize.
3. Change the password, and change it on every other site that used the same one or that sends its resets to this address.
4. Check the recovery phone and recovery email, apps with access to your account, and 2-Step Verification for anything you didn’t add. Google says it disables suspicious sign-in methods and gives you 30 days to confirm the ones you did add.
5. In Gmail settings, check delegation, automatic forwarding, filters, the vacation responder, the send-as address, and IMAP/POP access.

Signs that someone was inside the mailbox

Microsoft lists these as symptoms of a compromised mailbox. Any one of them is a reason to check the rest.

• Rules that forward mail to an unknown address, or move mail to Notes, Junk Email, or RSS Subscriptions.
• Messages in Sent Items or Deleted Items you didn’t write.
• Changes to your entry in the company address list: name, phone number, or postal code.
• A signature you didn’t write.
• Frequent password changes or lockouts nobody can explain.
• Missing or deleted mail.

Tell people, and tell them how

Call the people who received messages from the account, starting with anyone who was asked to pay something or change payment details. A call to a number you already had can’t be intercepted by whoever is in your mailbox.

For everyone else, the FTC advises a short notice that says not to click links in messages from you and to ignore pleas for money. If you send it by email, leave out hyperlinks so the notice doesn’t look like phishing.

Report it to the FTC at ReportFraud.ftc.gov and to the FBI at IC3.gov. If money has already gone out, see the page on what to do today when money has been sent to a fraudster.

What these steps can and can’t tell you

Taking the account back ends the access you found. It doesn’t tell you which messages were read, what was downloaded, or what the intruder sent from this address before you looked. The FTC notes that someone with your inbox can request password resets for your other accounts, so the list of sites to change includes anything that emails you a reset link.

We look at this with you and tell you what we found and what we didn’t, with dates. A clean listing covers what we examined, on the day we examined it.

A password change closes one door, and the intruder may have left others open.

Related

• A Forwarding Rule in Your Email You Didn’t Create
• Sign-In Approval Prompts on Your Phone You Didn’t Start
• Keeping Evidence Before You Clean Up a Computer
• Money Sent to a Fraudster: What to Do Today

Sources

• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Learn: Remove blocked users from the Restricted entities page
• Google Account Help: Secure a hacked or compromised Google Account
• FTC Consumer Advice: How to recover your hacked email or social media account
• FTC Business Guidance: Small business? Know how to stop a would-be business impersonator