No Ticket Needed

Appearance

What to Do When Your Business Email Has Been Hacked

Applies toMicrosoft 365Google Workspace
60 min fix Updated 21 Jul 2026

By , 10+ years in IT support and helpdesk How these guides are checked

Quick Answer

Immediately reset your email password and force a 'sign out of all sessions'. Then, check your inbox rules for hidden forwarding rules created by the hacker, turn on Multi-Factor Authentication (MFA), and audit your sent items for phishing emails sent to your clients.

Checked against Microsoft Learn - new Outlook for Windows, Microsoft Learn - end of support and retirement and between 5 Aug 2026 and 12 Sep 2026. Nothing published in that period has been linked to this guide.

Estimated Time to Fix: 1 hour

Summary ​

Discovering your business email has been hacked is terrifying. For a solo business owner, your email is the master key to everything: your bank, your website, your social media, and your clients. Do not panic. If you follow these steps immediately, you can lock the hacker out and minimize the damage.

Symptoms ​

  • Clients tell you they received a weird email or a fake invoice from you.
  • You see emails in your "Sent Items" that you did not write.
  • You randomly stop receiving emails from specific clients (because the hacker hid them).
  • You receive a "Password changed" alert that you didn't initiate.

Before You Start ​

  • You must still be able to log into your account, or have the ability to reset the password via SMS/backup email.

Instructions ​

Step 1: Lock the Hacker Out ​

Changing your password is not enough. If the hacker is currently logged in, changing the password does not kick them out. You must force a sign-out.

  1. Change your password: Make it a 14+ character passphrase that you have never used anywhere else.
  2. Force a Sign-Out:
    • Microsoft 365: Go to mysignins.microsoft.com, click Security Info, and look for the option to Sign out everywhere.
    • Google Workspace: Go to myaccount.google.com/security, scroll down to Your devices, click Manage all devices, and click Sign out on everything you don't recognize.

Step 2: Delete Malicious Inbox Rules (CRITICAL) ​

Hackers are smart. They don't want you to know they are in your inbox. They will create "Rules" that automatically move emails from your biggest clients—or emails from your bank—into obscure folders like "RSS Feeds" or "Archive" so you never see them. They may also forward all your email to an external Yahoo address.

  1. Open Outlook on the web (or Gmail).
  2. Go to Settings > Mail > Rules.
  3. Delete any rule you do not explicitly remember creating.
  4. Go to Settings > Mail > Forwarding.
  5. If forwarding is turned on to an email address you don't own, turn it off immediately.

Step 3: Turn on MFA ​

If you had MFA, you wouldn't have been hacked. Turn it on now so it never happens again.

  1. Download the Microsoft Authenticator or Google Authenticator app on your phone.
  2. Go to your account security settings and enable Two-Step Verification / MFA.
  3. Scan the QR code with your phone. (See related articles below for a full guide).

Step 4: Audit the Damage ​

You need to know what the hacker did while they were inside.

  1. Check your Sent Items and your Deleted Items (hackers delete their sent mail to hide it).
  2. Did they send fake invoices to your clients with altered bank routing numbers?
  3. Did they request password resets for your bank, your domain registrar, or your accounting software?

Step 5: Notify Your Clients ​

If the hacker sent emails to your clients, you must do the hardest thing: tell them.

Send a brief, professional email to your contacts: "Earlier today, my email account was briefly compromised. If you received an email from me requesting payment to a new bank account, or containing a link to view a 'Secure Document,' please delete it immediately. The issue has been resolved and the account is secure."

Troubleshooting ​

WARNING

If you cannot log into your account at all because the hacker changed the password and the recovery phone number, you must contact Microsoft or Google Data Protection support immediately. Be prepared to provide legal documentation proving you own the business.

Symptom / ErrorPotential CauseSolution
I'm locked out by the hacker's MFAHacker added their own phoneIf you are the global admin of a Microsoft tenant, you will have to call Microsoft Support to prove ownership. It can take several days to regain access.
Emails are still going missingMissed a forwarding ruleDouble-check Outlook Web > Settings > Mail > Forwarding. Also, check if they added an "Alias" to your account in the Admin Center.

Last updated:

Frequently asked questions

How did they hack me if I never shared my password?
They likely bought your password on the dark web from a breach at another company (if you reuse passwords), or you fell victim to a phishing email that looked like a fake Microsoft or Google login page.
Should I email my clients and tell them?
Yes, if the hacker used your account to send them fake invoices or phishing links. Honesty protects your clients from losing money and protects your reputation.