Business Email Hacked? Secure the Account and Domain

Business email hacked? Treat unexpected sign-ins, changed forwarding rules or fraudulent messages as an incident that needs prompt containment and investigation. Contact the account administrator through a trusted channel. Do not rely on the potentially compromised mailbox to coordinate the response.

Business email hacked: protect urgent transactions

If a suspicious message asks for a payment or a change of bank details, pause and verify through a known contact method. Do not call a number supplied only in the suspicious email. If money or banking details may be involved, contact the bank immediately through its official channel. The Australian Government’s business email compromise recovery guidance explains the immediate response priorities.

Contain access through the authorised administrator

Use a trusted device and the provider’s official administration or recovery process. For Microsoft 365, the authorised administrator should follow Microsoft’s compromised-account response guidance. The response can include restricting access, resetting the password, revoking sessions and reviewing authentication methods and permissions.

A password reset alone is not a complete investigation. Ask the administrator to check suspicious forwarding and inbox rules, application access and unexpected account changes. Preserve relevant evidence while containing the incident. Do not disable multifactor authentication or approve unexpected sign-in prompts to regain access quickly.

Preserve evidence when business email is hacked

Record the first known suspicious event, the affected accounts and the time with its timezone. Keep examples of fraudulent messages and available sign-in or audit records in an access-controlled location. Avoid forwarding sensitive customer information to unrelated personal accounts or posting screenshots publicly.

Distinguish confirmed facts from assumptions. A message that appears to come from the business may involve spoofing, a compromised account or another sender. The investigation should establish which case applies rather than assuming every suspicious email proves the mailbox itself was accessed.

Check what the attacker may have changed

Ask the responsible specialist to review the account’s configuration and activity during the suspected period. Look beyond the Inbox: forwarding, rules, delegated access and connected applications can affect what the user sees and what leaves the account. Review recovery contacts and privileged roles as part of the authorised response.

Check the devices used to access the mailbox if there are signs of malware or stolen credentials. Keep the response coordinated so one person does not restore a setting that another removed for containment. Document each action and its outcome.

Coordinate customer and supplier communication

If fraudulent instructions went to others, decide who needs a verified warning and who will send it. Use a trusted channel that the incident team considers safe. Keep the message factual about what is known and what recipients should verify; do not make unsupported claims about the extent of access.

Where personal information, payment fraud or contractual obligations may be involved, seek appropriate incident-response and legal advice. This guide is not a substitute for assessing the circumstances and applicable notification requirements.

Verify recovery after business email is hacked

Test legitimate sign-in and mail flow after the administrator completes the response. Confirm the intended forwarding, rules and access permissions, then monitor for further suspicious activity. A working inbox does not by itself prove that all malicious access has ended.

Keep a final record of the confirmed findings, actions, remaining uncertainties and follow-up owner. Review how the incident began where evidence allows, and improve the relevant controls. TempWebz provides Microsoft 365 support and technical support for businesses needing help coordinating account and email checks.