Treat it as urgent. Reset the password, revoke all sessions, turn on multi-factor authentication, and remove any inbox rules or forwarding the attacker added. Then check what the attacker may have sent or accessed.
Common causes
Phished password
Most compromised business mailboxes start with a fake login page.
No multi-factor authentication
Without MFA, a stolen password is all an attacker needs.
Reused passwords
Passwords leaked from other sites are tried against business email.
Malicious app consent
Some attacks trick users into granting an app access to their mailbox.
How to fix it, step by step
- 1
Reset the password
Use a strong, unique password from a trusted device.
- 2
Revoke sessions and enable MFA
Sign out all sessions and require multi-factor authentication.
- 3
Remove malicious rules and forwarding
Check inbox rules and forwarding settings in Outlook on the web.
- 4
Review sign-in activity
Your administrator can review Microsoft 365 sign-in logs for unusual locations.
- 5
Check sent items and deleted items
See what the attacker sent, and whether they deleted evidence.
- 6
Notify affected contacts
Warn customers and vendors, especially about any payment or banking change requests.
When to call a technician
A hacked mailbox is often used to send fake invoices to your customers. We contain the breach, investigate what was accessed, and set up protections like MFA and alerts so it doesn't happen again.
On-site support across Orange County · see our IT support, managed IT, Microsoft 365 support and cybersecurity services.
Frequently asked questions
How do I know if my email was hacked?
Signs include emails you didn't send, missing replies, new inbox rules, password reset emails you didn't request, and sign-in alerts from other locations.
Should I tell my customers?
Yes, if messages were sent from your account — especially anything involving payments.
Does Microsoft 365 have security alerts?
Yes. Alerts for suspicious sign-ins and forwarding rules can be set up and sent to your IT contact.