What to Do If Your Business Email Account Is Compromised

Recognize the signs without jumping to conclusions

Unexpected forwarding, inbox rules you did not create, unfamiliar sent messages, new authentication methods, sign-in alerts, and unexplained account changes are reasons to investigate. A missing email alone may have another explanation, so collect the details rather than assume a specific cause.

Write down when the issue was noticed, who reported it, and what activity is unusual. Keep relevant messages and screenshots. Do not start deleting mailbox contents or reconfiguring the account in ways that make it harder for the administrator to understand what happened.

Contact IT through a channel the attacker does not control

If the mailbox may be compromised, do not use it as the only place to discuss recovery or deliver a new password. Call a known support number or use another approved communication method.

Tell the administrator whether you entered credentials on a suspicious page, approved an unexpected MFA request, lost a device, or received a supplier complaint. A prompt, honest account of the sequence is more useful than waiting to find a perfectly worded explanation.

Limit access under the administrator’s direction

The administrator may need to disable sign-in while investigating, reset credentials in the correct identity system, and revoke active sessions. Hybrid or federated accounts need the right source of authority considered rather than a random password change in one portal.

Changing the password does not address every persistence mechanism. Session revocation, token behavior, and connected applications need review. Do not assume that every attacker loses every type of access instantly because one password was reset.

Review the places an attacker may have changed

Microsoft publishes an account-compromise response guide covering these areas. Your administrator should apply the guidance to the actual tenant and available tools, preserving the information needed to understand scope and timing.

• Mailbox forwarding and inbox rules, including rules the user cannot easily see.
• Registered MFA methods and unfamiliar devices.
• Applications granted consent or account permissions.
• Administrative roles or other unexpected access changes.
• Sign-in activity, audit records, and suspicious outgoing messages.

Coordinate the business impact

Determine whether the account was used to contact clients or suppliers, view sensitive information, or change payment instructions. Communications to affected parties should be coordinated with the responsible business contacts and any incident advisers.

If a bank transfer or payment is involved, the financial-response clock is separate from the technical investigation. Call the bank using a trusted number. Discuss any insurance, legal, or reporting requirements with the responsible advisers rather than assume the mailbox repair resolves the whole incident.

Recover access and close the practical gaps

After investigation and remediation, the administrator can restore normal access according to the response plan. Review authentication methods, permissions, endpoint condition, email defenses, and staff reporting habits.

For a Louisville business, Level UP IT can help coordinate identity security, mailbox review, endpoint support, and recovery priorities. Call to discuss an active incident and confirm availability. Do not include passwords, recovery codes, or confidential evidence in a public contact form.