What to Do When Your Business Email Has Been Hacked
In this article:
- How Do You Know Your Email Has Actually Been Hacked?
- The First Five Minutes: Contain the Damage
- Lock the Account Back Down
- Why Does a Hacked Business Email Matter More Than You Think?
- Who Do You Need to Tell?
- What Should You Do Once the Account Is Secure?
- How Can You Stop This From Happening Again?
- Moving Forward With Confidence
A client texts you: “Hey, did you mean to send that invoice with the new bank account number?” You didn’t send it. That’s usually the first sign a business email account has been hacked, and it’s a moment that calls for a clear head and a clear plan.
Business email carries more risk than a personal inbox. It’s connected to vendor relationships, client trust, payment requests, and often other accounts that use it for password resets. When an attacker gets into that inbox, the damage isn’t limited to spam. It can turn into fraud, data exposure, or a compliance problem, fast.
This guide walks through exactly what to do when your business email has been hacked, from containing the breach to notifying the right people to making sure it doesn’t happen again.
How Do You Know Your Email Has Actually Been Hacked?
A few signs tend to show up together, and any one of them is worth investigating right away. According to Experian’s guide to hacked accounts, the clearest indicators include:
- You’re locked out. Your password no longer works and you didn’t change it.
- You get a login alert you don’t recognize: a new device, an unfamiliar location, or a login at an odd hour.
- Your sent folder has messages you didn’t write, often to your contacts or clients.
- New inbox rules appear that forward, hide, or delete certain messages without your knowledge.
- Contacts tell you they received something strange from you: an invoice, a link, or an urgent payment request.
If you notice even one of these, treat it as a hacked account until you’ve confirmed otherwise. Waiting to “see if anything else happens” gives an attacker more time inside your inbox.
The First Five Minutes: Contain the Damage
Disconnect the Affected Device From the Network
If you’re still logged in on a compromised device, disconnect it from Wi-Fi or your company network right away. This limits how much an attacker already on that device can do while you work on securing the account itself.
Try to Regain Access Immediately
If you can still log in, change your password now, before doing anything else. If you’ve been locked out, use your provider’s account recovery process. Most business email platforms, including Microsoft 365 and Google Workspace, have a dedicated recovery flow that verifies your identity through a backup email, phone number, or your IT administrator.
Check for Malicious Inbox Rules and Forwarding
This step gets skipped often, and it shouldn’t. Attackers frequently set up a forwarding rule that quietly sends copies of your incoming email, especially anything with words like “invoice,” “payment,” or “wire,” to an address they control. That rule can keep working even after you’ve changed your password, because it isn’t tied to the login itself. Check your account’s rules and forwarding settings for anything you didn’t create, and remove it immediately.
Lock the Account Back Down
Change Your Password: Everywhere It Was Reused
Choose a new password that shares nothing with the old one. If that same password protects any other account, change those too. Reused passwords are one of the most common ways a single hacked inbox turns into a much bigger problem.
Turn on Multi-Factor Authentication
If MFA wasn’t already active, turn it on now. Requiring a second verification step, like a code from an authenticator app, makes it significantly harder for someone to get back in even if they obtain your password again later.
Review Connected Apps, Recovery Info, and Login History
Look at what third-party apps have access to your account, and confirm your recovery email and phone number are still yours. Most email providers keep a login history showing devices, locations, and timestamps. Review it for anything unfamiliar, and revoke access for anything you don’t recognize.
Why Does a Hacked Business Email Matter More Than You Think?
A single compromised inbox can be the starting point for business email compromise, or BEC: a scam where an attacker uses a hijacked or spoofed account to trick employees, vendors, or clients into sending money or sensitive data. According to the FBI’s 2025 Internet Crime Complaint Center report, BEC generated nearly 25,000 complaints and roughly $3 billion in reported losses last year, making it one of the costliest categories of cybercrime the agency tracks. It’s not a threat limited to large corporations. Small businesses are common targets precisely because they often have fewer safeguards in place.
This is where the technical details of email security, the parts that seem invisible until something goes wrong, actually matter. We’ve built and maintained large-scale email infrastructure for clients that depend on secure, high-volume messaging, including proper DKIM and SPF configuration and ongoing DNS management to keep those systems trustworthy and hard to spoof. That kind of setup is more involved than most small businesses need day to day, but the underlying principle applies at any size: the stronger your email authentication and monitoring, the harder it is for an attacker to succeed in the first place.
Who Do You Need to Tell?
Notify Contacts and Clients
Send a short, direct message to anyone who may have received a suspicious email from your address. Ask them to ignore it, avoid clicking any links, and verify any payment or data request directly with you before acting on it. Use BCC so you’re not exposing everyone’s email address to the group.
Loop In Your IT Provider or Internal Team
If you have an IT provider or internal team, this is the moment to call them. They can review login history, close off any lingering access, check for malicious rules you might have missed, and confirm the account is genuinely secure, not just accessible again. Businesses that work with a technology partner they already trust tend to move through this process faster, simply because there’s already a relationship and a shared understanding of how their systems are set up.
When Does Compliance Come Into Play?
If your business handles protected health information or other regulated data, a hacked email account can turn into a compliance issue, not just a security one. Organizations in fields like healthcare should treat account compromise as a potential reportable event and involve whoever manages their compliance obligations early. Regular vulnerability scanning and penetration testing can also help identify weak points before they turn into an actual breach.
What Should You Do Once the Account Is Secure?
Run a Malware Scan
Before you consider the incident closed, run a full scan on the device where the compromise occurred, not just a quick scan. Attackers sometimes pair account takeovers with malware like keyloggers, which can capture your new password just as easily as your old one.
Check Other Accounts Tied to That Email
Any account that uses your business email for login or password resets is worth a second look, especially banking, payment processing, and other financial tools. If an attacker had access to your inbox, they may have already tried to reset passwords elsewhere.
Watch for Follow-Up Phishing Attempts
It’s common for contacts, and sometimes the attacker themselves, to send follow-up messages referencing the incident. Treat anything related to the hack with extra caution, and verify requests through a phone call or another channel before acting on them.
How Can You Stop This From Happening Again?
Most email hacks trace back to a handful of preventable gaps: reused passwords, no multi-factor authentication, and employees who haven’t been trained to spot phishing attempts. Addressing those three things closes off the most common ways attackers get in, and recent industry data shows BEC attack volume climbing further, so this isn’t a threat that’s leveling off.
Beyond the basics, ongoing monitoring makes a real difference. A managed IT services partnership can include account monitoring, security awareness training, and faster response if something does slip through, so an incident gets caught in minutes instead of days. For businesses in regulated industries, pairing that with periodic vulnerability scanning and penetration testing helps confirm that the fixes you put in place are actually holding up.
Moving Forward With Confidence
A hacked business email is stressful, but it’s also very manageable once you know the sequence: contain it, lock it back down, tell the people who need to know, and clean up what’s left. Most businesses that go through this come out the other side with a stronger setup than they started with, simply because the experience makes the gaps obvious.
If you’d rather not handle the next one alone, or you want a second set of eyes on your current email security setup, The Joseph Company has spent over 30 years helping Missouri and Illinois businesses keep their technology secure and running smoothly. Contact us to talk through your specific setup and find a practical way to protect your business going forward.