Our business email was hacked, what do I do?
Act in this order. Change the password on the compromised account, sign out every session, turn on multi-factor authentication, then check for mail forwarding rules, inbox rules and app passwords the attacker left behind. Read the sent items to see what went out, warn your finance people and any client who received something, and preserve the logs. Then find out how they got in. I take these calls from Dallas businesses at any hour.
Answered by Anthony Omini, Cross River Tech, Dallas
Key takeaways
- Changing the password is not enough on its own: an existing session, an app password or a mail rule will keep the attacker in after the reset.
- The step almost everyone misses is checking for forwarding and inbox rules, which is how attackers keep reading your mail silently for months.
- Read the sent items and the deleted items before anything is cleaned up, because that is where you learn who was targeted and what was said.
- If any invoice or bank-detail email was involved, treat it as attempted payment fraud immediately and call the bank rather than emailing anyone.
- Nearly every compromise I have cleaned up came down to the same two gaps: a reused password and no multi-factor authentication.
What should you do in the first hour, step by step?
Do these in order. If you have an IT provider, call them while you start on step one. If you do not, work down the list yourself and get help for the parts you cannot do. This is general guidance for a small business, not legal advice, and if money has already moved you should involve your bank and your attorney as well.
- Change the password on the compromised account. Use a new password that is not a variation of the old one and is not used anywhere else. Do it from a different computer if you suspect the person's machine itself is infected.
- Sign out every session. This is the step people skip, and skipping it means the attacker stays signed in with a valid session even after the password changed. In Microsoft 365 an administrator can sign a user out of all sessions from the admin center; Google Workspace has the same control. Do this immediately after the password change.
- Turn on multi-factor authentication for that account. Then for everyone else, starting with anyone who can move money or has administrator rights. Register a fresh method on a device you trust, and remove any authentication method or phone number you do not recognize, because attackers add their own.
- Check mail forwarding and inbox rules. Look at forwarding on the mailbox itself, and separately at inbox rules inside the mailbox. Attackers typically create a rule that forwards everything to an outside address, or one that quietly moves messages containing words like "invoice", "payment" or "wire" into an obscure folder so the real owner never sees the reply. Delete anything you did not create and write down what it was first.
- Revoke app passwords, connected apps and devices. App passwords bypass multi-factor authentication entirely, so remove all of them and reissue only what is genuinely needed. Review third-party apps that have been granted access to the mailbox, and remove unfamiliar registered devices.
- Read the sent items and deleted items. Before anyone cleans up. This tells you who received something from your address, what it said, and whether it asked anyone to pay or to change bank details. Take screenshots. Also check whether the signature was altered.
- Warn the people who need warning. Your finance person first, with a clear instruction that no payment or bank-detail change goes through without a phone call to a known number. Then anyone who received a suspicious message, by phone or from a different address. Keep the notice short and factual.
- Preserve the logs. Do not delete the mailbox, do not reset everything wholesale, and do not wipe the machine until someone has looked at the sign-in logs and the audit trail. In Microsoft 365 the sign-in logs and the unified audit log show where the sign-ins came from and what was done. That evidence matters for your insurer and for working out the scope.
- Then work out how they got in, and whether any other account is affected. One compromised mailbox is often the entry point rather than the target.
If money has already been sent, stop reading and call your bank's fraud line right now, then report it to the FBI's Internet Crime Complaint Center. Speed is the only thing that makes a recall possible.
What if someone is sending emails from your company address?
First establish which of two very different things is happening, because the response is not the same.
The account is genuinely compromised. Someone has your password and is signed in, sending from inside your mailbox. Signs: the messages appear in your sent items, replies come back to you, colleagues receive mail that looks perfectly normal and references real conversations, and there are sign-ins from places nobody visited. This is the situation the first-hour list above is written for.
Your address is being spoofed. Nobody is in your mailbox. An outsider is sending mail that displays your name or address, from their own server. Signs: nothing appears in your sent items, you receive bounce messages for mail you never sent, and the real sending address behind the display name is different when you look at the message headers. Spoofing is unpleasant but your data is not exposed.
The way to tell them apart quickly is to check the sent items and the sign-in logs. If there are no unexpected sign-ins and nothing in sent items, it is spoofing.
Spoofing is fixed at the domain level rather than in the mailbox: SPF, DKIM and DMARC are three records in your domain's DNS that tell receiving mail servers which systems are allowed to send as your company. Most small business domains I inspect are missing at least one of them, or have DMARC set to do nothing. Getting those right will not stop the messages being composed, but it makes receiving servers reject or quarantine them, which stops your clients seeing them. That work sits under Microsoft 365 and Google Workspace support.
A third possibility is worth naming: a look-alike domain. Someone registers a domain one character different from yours and emails your clients from it. Nothing in your systems is wrong at all, and the fix is to warn clients, register the obvious variants, and report the domain.
What do you check after the immediate containment?
Once the attacker is locked out, the question becomes scope: what did they see, what did they change, and are they still somewhere else in your environment? This is the part small businesses usually stop too early on.
- Every other account. If the password was reused, and it usually was, the same credentials may work elsewhere: the other mailboxes, the accounting system, the bank portal, the file storage, the practice or case management system, the payroll provider, the domain registrar.
- Administrator accounts. Check whether any new administrator was created, whether roles were changed, and whether anyone was added to a group that grants access.
- New users and new mailboxes. Attackers sometimes create a user to keep access after the original account is fixed.
- Mailbox permissions and delegates. Access can be granted to another mailbox, which survives a password change on the first one.
- Files and sharing links. Look at what was downloaded from OneDrive or SharePoint, and at any external sharing links created recently.
- The computer itself. If the password was stolen by malware rather than by phishing, the machine needs to be examined and probably rebuilt. Changing the password on an infected machine simply hands over the new one.
- Phone numbers and recovery details. On the account and on your domain registrar, because changing a recovery number is how an attacker keeps a way back in.
- Your bank and payment processors. Tell them what happened even if nothing moved, and ask what additional verification they can add to your account.
Then write down what you found. A short factual record of what happened, when, what was accessed and what you did about it is what your cyber-insurance carrier will ask for, and it is what you will be glad of if a client asks whether their information was exposed. Both the FTC and CISA publish plain-language small-business guidance on responding to an account compromise and on business email fraud; reading it alongside your own notes is a sensible sanity check.
How does business email get compromised in the first place?
Almost always one of a short list. None of it is exotic.
- Phishing. A message that looks like a Microsoft or Google sign-in prompt, a shared document notification, a voicemail, or a message from a colleague. The person types their password into a convincing fake page. This is the most common route by a wide margin.
- A reused password exposed elsewhere. A password used at work and also on a site that suffered a breach. Attackers try those combinations against business email constantly and automatically.
- No multi-factor authentication. Not itself the way in, but the reason a stolen password succeeds. With multi-factor authentication properly enforced, most of these attempts fail at the second step.
- Multi-factor fatigue. The attacker has the password and sends approval prompts repeatedly until a tired person taps approve. Number matching in the authenticator app is the countermeasure.
- Malware on the computer. Software that captures passwords or steals the session token from the browser, which lets the attacker in without needing the password or the second factor at all.
- Legacy sign-in methods. Old mail protocols that ignore multi-factor authentication entirely. If they are still enabled on your tenant, they are a door around the lock.
- A shared mailbox with a shared password. The info@ or accounts@ address everyone knows the password to, which nobody has changed since the last three employees left.
Notice that six of the seven are cheap to close. This is why I am blunt with clients about multi-factor authentication: the cost of turning it on is a short conversation per person, and the cost of not having it is the day you are having right now.
What about the money side?
This is the part that turns an IT incident into a business loss. The reason attackers sit inside a small business mailbox is rarely the email itself. It is the payments.
The pattern is consistent. They read quietly for weeks, learn who pays whom and how invoices are worded, then send a message at the right moment saying the bank details have changed. Sometimes they reply inside a real conversation thread, from the real address, which is why it works on careful people. Sometimes they wait for a large invoice and intercept it.
What to do straight away:
- Tell your finance person before you tell anyone else. No payment leaves and no bank detail changes without a verbal confirmation on a number already on file.
- Call any client or supplier who was emailed about payments during the compromise. Call, do not email.
- Call your bank if anything has moved, immediately. Recovery windows are short.
- Check your own outgoing invoices for the period, in case yours were altered before being sent.
- Tell your cyber-insurance carrier if you have a policy. Most require prompt notification and many provide response support that you have already paid for.
The permanent fix is a rule, not a product: any change of bank details, from anyone, is confirmed by voice on a number you already had, never on a number in the email. Write it down, tell every new hire, and apply it to the owner too. If you have received a request like this and are not sure, a supplier changing their bank details by email walks through how to check it.
How do you stop it happening again?
Cleaning up a compromise without changing anything means doing it again in a few months. The list below is what I put in place afterwards, in the order I do it.
- Multi-factor authentication for every account, with no exceptions. The exception is always the account that gets compromised. Use an authenticator app with number matching rather than text messages.
- Block legacy authentication so old protocols cannot bypass it.
- A password manager for the whole office, so nobody has to reuse passwords to cope.
- Alerting on new forwarding rules and suspicious sign-ins, so the next attempt raises a flag rather than being discovered by a client.
- SPF, DKIM and DMARC configured properly on your domain.
- External sender tagging, so mail from outside the company is visibly marked and impersonation is easier to spot.
- Fewer administrators, and admin accounts separate from daily mailboxes.
- A written offboarding routine so departed staff lose access the day they leave.
- A backup of your mailboxes and files that you control, because Microsoft keeping the service available is not the same as a copy you can restore from.
- A short conversation with the whole office about what current phishing looks like, and a clear message that reporting a mistake quickly is welcomed rather than punished. People hide mistakes when they are afraid, and hidden mistakes are what turn into serious incidents.
Most of that is configuration rather than purchase, and for a small office it is a day or two of work. The full picture of what to turn on is in Microsoft 365 security for a small business, and the ongoing side, including backups and monitoring, is covered under cybersecurity, backup and disaster recovery.
Who helps with a compromised email account in Dallas?
I do. I am Anthony Omini and I run Cross River Tech, a small, owner-led managed IT company in Dallas, and you deal with me directly. Account compromise is one of the calls I take most often, and it is almost entirely remote work, which means containment can start while you are still on the phone rather than after a drive across town.
What I do on this kind of call:
- Contain first: password, sessions, multi-factor authentication, rules, app passwords, in that order.
- Establish scope from the sign-in logs and the audit log, including whether other accounts were touched.
- Check the machine, because a stolen password and an infected computer need different responses.
- Help you work out who to tell, and what to say, without overstating or understating it.
- Write up what happened, what was accessed and what was changed, in a form you can hand to your insurer.
- Then fix the underlying gaps so the next attempt fails.
Rates for hourly work with no contract are $100 per hour remote and $150 per hour onsite during business hours, Monday to Friday, 8 AM to 5 PM Central, and $150 remote and $225 onsite after hours, weekends and holidays, with a one-hour minimum. Remote support is available around the clock including holidays, which matters here because compromises are usually noticed in the evening or at the weekend. Details are on the hourly IT support and break/fix page, and what can be fixed remotely explains why this particular emergency does not need anyone in the room.
If you are dealing with this right now, get in touch and say what has happened, or start on the first-hour list above while you wait. If you are reading this because it happened to someone you know and you would rather it did not happen to you, the same page is the place to start, and the honest first question I will ask is whether multi-factor authentication is on for everyone. Ongoing protection, monitoring and the rest of the day-to-day work sit under managed IT services, quoted per user or per device after a short conversation, month-to-month and cancel anytime.
Questions people ask
Our business email was hacked, what do I do first?
Change the password, then sign out every active session, because a password change alone leaves an existing session working. Turn on multi-factor authentication, then check mail forwarding and inbox rules and remove app passwords. Read the sent items to see what went out, warn your finance people and anyone who received something, and preserve the sign-in and audit logs before cleaning anything up.
Someone is sending emails from our company address. Are we hacked?
Not necessarily. If the messages appear in your sent items and there are sign-ins from unfamiliar locations, the account is compromised and you should start containment immediately. If nothing appears in sent items and you are only getting bounce messages, your address is being spoofed from outside. Spoofing is addressed at the domain level with SPF, DKIM and DMARC records rather than in the mailbox.
Why is changing the password not enough?
Because an attacker who is already signed in keeps that session until it is revoked, and because they usually leave a way back in. App passwords bypass multi-factor authentication, mailbox forwarding rules keep copying your mail outward, added authentication methods let them reset the password again, and mailbox delegation survives the reset. Password, sign-out, multi-factor authentication, rules, app passwords, in that order.
How did they get into our email?
Usually a phishing page that captured the password, or a password reused on a site that was breached, in both cases on an account without multi-factor authentication. Less often it is malware stealing a session token from the browser, repeated approval prompts until someone taps accept, or an old mail protocol that ignores multi-factor authentication. Most of these are cheap to close once you know which one it was.
Should we tell our clients that our email was compromised?
Tell anyone who received a message from the account during the compromise, especially anything about invoices or payments, and do it by phone or from a different address. Keep it short and factual. If personal information belonging to clients was exposed, notification duties may apply depending on your industry and the data involved, so take advice from your attorney rather than deciding alone.
Who helps with a compromised business email account in Dallas?
I do, and the work is almost entirely remote, so containment can start during the first phone call rather than after a drive across town. Hourly rates are $100 remote and $150 onsite in business hours, and $150 remote and $225 onsite after hours, weekends and holidays, with a one-hour minimum. Remote support is available around the clock, which matters because these are usually noticed at night.
