Hacked Business Email? Why a New Password Is Only Step One

If you are dealing with a hacked business email account, changing the password is the right first move. Unfortunately, it is rarely the last one. While they were inside, an attacker may have set up quiet ways to keep reading your mail long after the old password stops working.

Why a hacked business email account is so dangerous

Email is the hub for almost everything else your business uses. Reset links for your accounting software, cloud storage, bank portal, and social media accounts all land there.

So if someone can still read the inbox, they may be able to reach those other systems too. That is why the recovery steps from Microsoft and Google go well beyond a new password.

A new password does not end every session

Email services keep you signed in so you do not have to re-enter your password with each new message. Once you log in, your browser or mail app holds a token that says, in effect, this login was already approved.

That token can keep working until it expires or someone cancels it. As a result, an attacker who signed in before the password change may stay connected for a while.

Each provider handles this a little differently. Google says a password change signs you out in most places, but it lists some exceptions for devices and apps. Microsoft tells admins to disable the account while they look into it and to end open sessions as a separate step.

Malware adds another twist. If it stole a session cookie from an employee’s computer, the attacker may not need the new password at all.

What to do

• Have your admin end all sessions and tokens for the account. The setting may be called revoke sessions, reset sign-in cookies, or sign out everywhere.
• If malware is possible, start the cleanup from a different device.
• Check the employee’s computer before they sign in again.

Forwarding rules can leak your email quietly

Next, look at what changed inside the mailbox.

A common trick is a forwarding rule that copies every new message to an outside address. A sneakier version only forwards mail that mentions an invoice, a bank, a payment, or a reset link.

Because most email still arrives as normal, these targeted rules are hard to spot. Meanwhile, the attacker gets exactly what they want.

Rules can also cover an attacker’s tracks. One might quietly move security alerts, or a customer’s question about a payment, into a folder nobody opens.

In Microsoft 365, have an admin review all inbox rules from the admin tools, including hidden ones. Checking Outlook alone can miss them.

The most dangerous forwarding rule is the one that only forwards invoices.

Connected apps may still have access

Forwarding is one way back in. A connected app is another.

Many businesses link email to scheduling tools, customer databases, mobile mail apps, and browser add-ons. These links often use a standard called OAuth, which gives an app access to parts of the account without storing the password.

Attackers abuse this by building an app that looks real and asking the user to approve it. According to Microsoft’s app consent guide, one bad approval can expose email, files, contacts, and forwarding rules.

Some app links end when the password changes, while others do not. Therefore, review every connected app and remove anything your business does not know or use. A familiar name and logo prove nothing about who built the app.

Someone else may have mailbox access

Business email lets one person open another person’s mailbox. For instance, an assistant may manage an owner’s inbox, or a team may share one.

This is called delegation. Since a delegate uses their own login, changing the owner’s password does not remove them.

Check every person and group with access, and remove any access nobody can explain. Pay close attention to Send As rights. Someone with that right can send mail that looks like it came straight from the account.

Check recovery and sign-in methods

While they had control, an attacker may have added a phone number, a recovery email, an authenticator app, a passkey, or a security key. Any of these could let them come back later or approve a new sign-in.

Go through every method with the account owner. Then delete any entry nobody can account for.

How to secure a hacked business email account

Several of these settings are only visible to an admin. So bring in your IT provider, rather than asking the employee to clean up from their own inbox.

1. Suspend the account and end all sessions. A short pause for the employee is better than more time for the attacker.
2. Set a new, unique password. Share it by phone or through a password manager, never by email to the affected inbox. If the old password was used anywhere else, change those accounts too.
3. Remove old app passwords. Microsoft notes that these do not reset when the main password changes.
4. Review mailbox settings. Check forwarding, rules, filters, blocked senders, delegates, send rights, signatures, auto-replies, and connected apps.
5. Review sign-in methods. Look at every device, phone number, backup email, authenticator app, passkey, and security key.
6. Find out what happened. Look through Sent, Deleted, Drafts, Junk, and Archive for messages the employee did not write. Then have the admin review sign-in and audit logs, starting before the first warning sign.
7. Warn anyone who got a fake message. Reach them through a channel you trust, and focus on messages about invoices, bank details, payroll, or gift cards.
8. Return the account with MFA turned on. Use passkeys or security keys where you can, since they stand up to fake login pages better than codes do.

If money may have gone to the wrong account, call your bank right away. Use a number from its website or your own records, not one from the email thread.

Keep in mind that a login from an odd location does not prove a break-in. VPNs and mobile networks can throw off location data. Instead, look at the device, the time, the app, and the activity together.

How to keep it from happening again

• Block automatic forwarding to outside addresses unless there is a business reason for it.
• Limit which outside apps employees can connect to email.
• Require MFA on every account, starting with admins and anyone who handles payments.
• Ask staff to report odd MFA prompts, login alerts, or sent messages they do not recognize, right away.

Recovery is also easier when the mail itself is backed up. Our Microsoft 365 and Google Workspace backup keeps a copy outside the account, and Business Security Essentials covers MFA and monitoring for your whole team.

Frequently asked questions