Business email hacked? Here's what to do.

Signs your email has been compromised

• Customers or suppliers ask about emails you didn't send, often invoices or "updated bank details".
• Replies to your emails go missing, or messages appear already read.
• Sign-in alerts from places you've never been, or password reset emails you didn't request.
• A sudden flood of bounce-backs, or your account blocked from sending.
• Unfamiliar rules, forwarding addresses or apps in your mailbox settings.

Do this in the first hour

1. Don't delete anything. Suspicious emails, alerts and sent items are the evidence of what happened.
2. Change the password from a different, trusted device, and make it one you've never used anywhere else.
3. Sign the account out everywhere, so the attacker's open sessions are ended too. Changing the password alone doesn't always do this.
4. Turn on multi-factor authentication, and check no unfamiliar phone or app has been added as a sign-in method.
5. If money or bank details may be involved, call your bank straight away.
6. Warn your key contacts by phone, not from the affected mailbox.

Then call me on 03333 401 999. Treat it as an emergency: in most cases I can start working on it remotely within the hour.

What attackers leave behind

Changing the password is rarely the end of it. Attackers know they'll be found eventually, so they quietly set up ways to keep watching or get back in:

• Inbox rules that hide replies or move messages about invoices and payments to an obscure folder.
• Forwarding that silently copies every email to an outside address.
• App access, where a rogue app was granted permission to read the mailbox and keeps working after a password change.
• Extra sign-in methods, such as their own phone added for multi-factor authentication.
• Delegated access given to another account inside your organisation.

In Microsoft 365 these live across Outlook, the Exchange admin centre and Microsoft Entra. In Google Workspace they're split between Gmail settings and the Admin console. Missing one is how the same attacker comes back next month.

Find out what they saw

Sign-in logs and mailbox audit records show when the attacker got in, from where, and what they opened, sent or deleted. That tells you who to warn, and whether you have a reportable data breach. If personal data was exposed and it's likely to put people at risk, it needs reporting to the ICO within 72 hours of you becoming aware of it.

If you've lost money, report it to Report Fraud on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101. If you have cyber insurance, tell your insurer early, as most policies expect prompt notice.

How I help

My incident response starts with a fixed-fee first response of £795: lock the attacker out, remove what they left behind, and a preliminary investigation so you know where you stand. After that you get a fixed quote for anything more, such as a full investigation, recovery or reporting. Nothing goes ahead until you've agreed it.

Fake invoices going out from your address? Read how invoice fraud works and how to stop it, and run the free email security checker to see whether your domain can be spoofed too.