My business email has been hacked. What do I do?

How do I know if my email has been hacked?

Common signs:

• emails in your Sent folder that you didn’t write
• customers asking about messages or invoices you never sent
• a password that suddenly stops working
• security alerts about a sign-in from somewhere new
• emails you expected that never arrived, which a hidden rule may be moving or forwarding

Not sure whether it’s hacking or someone faking your address? Start with Someone is sending emails from my address. Have I been hacked or spoofed?

What should I do first?

Do these steps in order, today. Use a computer or phone you trust, not one you think might have a virus.

Step 1: Take the account back

Google Workspace

1. Sign in to the Google Admin console (admin.google.com) as an administrator.
2. Go to Menu › Directory › Users and select the affected user.
3. Click Reset password and set a new, long password that isn’t used anywhere else.
4. On the user’s page, click Security › Sign-in cookies › Reset. This signs them out of their active sessions, including the attacker’s. It can take up to an hour to end current Gmail sessions (Google: sign a user out).

Microsoft 365

1. Sign in to the Microsoft 365 admin centre (admin.microsoft.com) as an administrator.
2. Go to Users › Active users and select the affected user.
3. Choose Reset password and set a new, long password that isn’t used anywhere else.
4. Open the user again and, on the Account tab, choose Sign out of all sessions. They’ll be asked to sign in again within an hour (Microsoft).

If the hacked account is the only administrator, use your recovery details to get back in first. If you can’t, Google and Microsoft both have account recovery processes for administrators. Expect it to take time.

Step 2: Turn on two-step sign-in

Two-step sign-in (also called 2SV or MFA) means signing in needs a code from your phone, or a passkey, as well as the password. A stolen password alone then isn’t enough.

• Google Workspace: Admin console, Security › Authentication › 2-step verification. Tick Allow users to turn on 2-Step Verification, then set Enforcement to On once everyone has set it up (Google).
• Microsoft 365: in the Microsoft Entra admin centre, go to Entra ID › Overview › Properties › Manage security defaults and set it to Enabled. This requires two-step sign-in for everyone (Microsoft).

Step 3: Remove what the attacker left behind

Attackers often set things up so they can keep reading your email after you change the password. Check and remove anything you don’t recognise:

• Forwarding: Gmail Settings › Forwarding and POP/IMAP; Outlook Settings › Mail › Forwarding.
• Rules and filters: Gmail Settings › Filters and blocked addresses; Outlook Settings › Mail › Rules. Look especially for rules that delete emails or move them to RSS, Archive or other folders you never open.
• Connected apps: in your Google Account, Security › Your connections to third-party apps and services; in Microsoft, myapps.microsoft.com and your account’s App permissions. Remove anything you didn’t add.
• Delegates: anyone given access to the mailbox (Gmail Settings › Accounts; in Microsoft 365, the user’s Mailbox permissions in the admin centre).
• New administrators: check nobody has been made an admin who shouldn’t be.

Step 4: Work out what happened

• Look through the Sent folder and Deleted items for messages the attacker sent.
• Check the sign-in history to see when they first got in (see the hacked or spoofed guide for where to find it).
• Note dates, times and anything you change. Your insurer, your bank or the police may ask.

Do I need to report a hacked business email?

Possibly to several people. Use the “Who to tell” list below. Two points matter most:

• If money was sent because of an email from the hacked account, call your bank straight away. See My customer paid the wrong bank account.
• If the mailbox holds personal data, such as customers’ names, addresses, bank details or anything about your staff, this may be a personal data breach. You must report it to the ICO without undue delay, and within 72 hours of becoming aware of it, unless it’s unlikely to put people’s rights and freedoms at risk (ICO: personal data breaches). Whether you report it or not, keep a record of what happened and what you decided.

Report fraud and cyber crime to Report Fraud (reportfraud.police.uk), which replaced Action Fraud. The NCSC’s small business guide to response and recovery is also worth a read.

How do I stop it happening again?

• Keep two-step sign-in on for everyone, not just the account that was hacked.
• Use a password manager, so every account has a different password.
• Set up SPF, DKIM and DMARC on your domain, so criminals can’t easily send fake emails in your name. See Why are my emails going to spam or junk?
• Keep a separate administrator account that isn’t used for everyday email.

We can help during working hours, Monday to Friday. We don’t offer out-of-hours or emergency cover, so if you have cyber insurance, call your insurer’s helpline first.