A compromised business mailbox can expose internal conversations, enable fraudulent messages and create additional risks for customers and employees. Fast action is important.
1. Change the password immediately
If you can still access the account, create a strong new password that has never been used before.
2. Check other accounts
If the same password was reused elsewhere, update those accounts as well.
3. Review forwarding and mailbox rules
Attackers sometimes create forwarding rules to silently copy incoming messages to another address.
4. Review sent messages
If unauthorized messages were sent, inform affected employees, customers or partners.
5. Notify the administrator or technical team
Business account incidents should be reviewed at both the mailbox and server-security level.
6. Review access logs
Suspicious IP addresses and repeated failed logins may provide useful information about the attack.
For preventative measures, read our Business Email Security Guide.