Business email hacked? What to do in the first hour

If you think someone is inside a business mailbox right now, treat it as an active incident — not a help-desk ticket to schedule later. This page is a practical containment checklist for small teams on Microsoft 365 or Google Workspace. It is general guidance, not hands-on incident response. Use an authorized administrator or a contracted response provider for tenant changes and forensic decisions.

First ten minutes: contain the account

Speed beats perfect understanding. Do these steps in order from a device you trust:

• Change the compromised account password immediately, using a long unique passphrase.
• Sign the account out of every session. In Microsoft 365, use the admin center user blade to sign out of all sessions. In Google Workspace, use Admin console → user → Security → Sign out.
• Turn on multi-factor authentication if it is not already enforced, and remove MFA methods you do not recognize.
• Open inbox rules and delete any rule you did not create — especially rules that forward, delete, archive, or hide mail containing invoice, payment, wire, or bank.
• Check forwarding and remove any external forwarding address you did not set up.

Those five moves cut the most common persistence paths attackers use while you still have partial control of the mailbox. Do not wait for a perfect root-cause story before resetting the password and ending sessions.

Next: hunt what survives a password reset

Password resets do not always end a compromise. Have an authorized administrator review:

• Third-party apps and OAuth grants on the mailbox — revoke anything unfamiliar. App grants can survive password changes.
• Delegated mailbox permissions and unexpected full-access grants.
• New admin roles, privileged group membership, or freshly created user accounts.
• MFA phone numbers, authenticator apps, or app passwords the owner does not recognize.
• Recent sign-in locations and clients that do not match normal work patterns.

On Microsoft 365, search available Purview audit records around the suspected window for inbox-rule changes, forwarding changes, mailbox permission grants, and unusual sign-ins. On Google Workspace, review Admin audit activity for forwarding, app authorization, and suspicious login signals Google exposes for your edition. Record availability depends on license, configuration, retention, and API coverage.

Warn people who might get robbed

A compromised business email account is often used for payment fraud. Contact affected customers, vendors, and internal finance through a channel you already trust — phone numbers on file, not a reply to a suspicious thread — and ask them to verify any recent payment-instruction changes before sending funds.

If money already moved, call your financial institution immediately and open the appropriate law-enforcement or reporting channel. In the United States, ic3.gov is the FBI Internet Crime Complaint Center. Recovery is not guaranteed. Preserve mailbox evidence before mass-deleting messages; your administrator or counsel may need headers, rule history, and audit exports later.

What “hacked business email” usually looks like

Many small-business cases are not Hollywood malware. They are a phished password, a reused credential from a breach, or a session left open, followed by quiet setup: a hidden rule, an external forward, or a lookalike invoice sent from the real address during a genuine vendor conversation. The owner may still see an empty morning inbox while payment threads never surface.

That is why containment must include rules and forwarding, not only the password. It is also why supported audit records matter after the firefight: unexpected-location sign-ins, New-InboxRule or Set-InboxRule style events, Set-Mailbox forwarding parameters, Add-MailboxPermission, and MFA or role changes can show what the attacker did — when the provider still has those records.

Catch the next attempt sooner — without pretending you bought a SOC

After containment, decide how you will notice the next compromise before the wire leaves. Manual Purview or Google Admin searches only work if someone owns a schedule. InboxGuards is a self-serve account-takeover alarm: it connects with read-only access to supported Microsoft 365 or Google Workspace audit records, checks them at the fastest cadence available on standard plans — no premium security licensing required — and emails plain-English alerts when a configured rule matches. Provider ingestion delays and API coverage still apply.

InboxGuards is an alarm, not a staffed SOC or duty team. It does not sit between you and an attacker, does not change tenant settings, and does not guarantee every incident produces a visible or timely record. Monitoring is $2 per active user per month with a 30-day money-back guarantee. Hands-on remediation is not included; an optional $199 flat-fee remediation can be separately authorized when you want help making tenant changes.

After-action checklist you can hand to your admin

Document the timeline, who authorized each change, which rules and grants were removed, which contacts were warned, and whether audit exports were saved. Re-check MFA coverage on the affected account and peers with similar access. Review payment-verification procedures so the next “updated bank details” email still requires an out-of-band confirm. If you use cyber insurance, notify your broker according to the policy — InboxGuards reports are monitoring records only; carriers decide underwriting and claims on their own rules.

Start authorized audit monitoring at inboxguards.com/register, read what business email compromise is, or see pricing.