What to Do After a Business Email Account Is Compromised

Step one: contain the account immediately

1. Reset the password immediately, using a strong, unique password.
2. Revoke all active sessions and sign the account out of every device, not just the one in front of you.
3. Enable or re-verify multi-factor authentication on the account.
4. Disable the account temporarily if you cannot confirm containment quickly.

Check for hidden inbox rules

One of the most common tactics after an email account is compromised is creating a hidden forwarding rule or inbox rule that silently copies messages, particularly anything mentioning invoices, wire transfers, or passwords, to an external address. These rules often stay active even after the password has been changed, so check the mailbox rules specifically rather than assuming a password reset alone solves the problem.

In Microsoft 365, this means reviewing both inbox rules and mail forwarding settings in the admin center, since attackers sometimes configure forwarding at the transport level rather than through a visible inbox rule a user would notice.

Review sign-in activity and connected apps

• Check sign-in logs for locations and devices that do not match the legitimate user's normal pattern.
• Review any third-party applications the account has granted access to, since OAuth consent phishing is a common access method covered in our article on how hackers get into Microsoft 365 accounts.
• Revoke access for any application that was not deliberately and knowingly authorized.
• Check whether any new mail delegation or account permissions were added.

Assess what the attacker could have seen or sent

Once containment is underway, work through what the compromised mailbox actually had access to. This includes past sent and received emails containing sensitive information, contact lists that could now be targeted with follow-up phishing, and any fraudulent emails the attacker may have sent while inside the account, particularly ones asking for payment or banking detail changes.

Notify the people who need to know

• Clients or vendors who may have received a fraudulent email from the compromised account.
• Your bank if any financial instructions were sent or received while the account was compromised.
• Your cyber insurer, if a policy is in place, since many require prompt notification.
• Staff internally, so they know to be alert for follow-up phishing referencing the incident.

Check whether the compromise reached further than email

A compromised email account is frequently the first step, not the whole incident. If the account had access to financial systems, cloud storage, or was used to reset passwords elsewhere, those systems need to be checked as well. Our broader guide on what to do if your business has been hacked covers the wider incident response process beyond a single email account.

Fix the root cause, not just the symptom

Resetting a password addresses the immediate access but not necessarily how the attacker got in. If the root cause was a phishing email that stole a session token, or a lack of multi-factor authentication, or a reused password, that gap needs to be closed for every account in the business, not just the one that was compromised. Our Microsoft 365 security best practices guide covers the tenant-wide settings worth reviewing after any account compromise.

Preventing a repeat

• Enforce phishing-resistant multi-factor authentication on every account, not just the ones that were affected.
• Disable legacy authentication protocols tenant-wide.
• Roll out staff training that specifically covers the tactic used in this incident.
• Review and tighten conditional access policies for sign-in locations and device compliance.

Sources and further reading

• Canadian Centre for Cyber Security: Report an incident
• Microsoft Learn: Responding to a compromised email account

Frequently asked questions