Your work email was hacked: what to do in the first hour

A client calls about an odd email you never sent. Or a reply turns up to a message you didn't write. Someone else is in your mailbox, reading what you read and able to write as you.

This is the plan for the next hour, in order. Do the first section before you read the rest.

If money has already moved, start with the bank. Go to step 9, make that call, then come back to step 1.

The first ten minutes: lock them out

1. Pick up a different device. Use a phone on cellular data, or a computer that has never been used for that mailbox. If the attacker got in through something you opened, the original computer may be passing along everything you type, including the new password.

2. Change the password, then force a sign-out everywhere. A new password alone doesn't always close a session that's already open, so the attacker can stay signed in. Whoever administers your email needs to do both:

• Microsoft 365: in the admin center, open the user, choose "Sign out of all sessions," then reset the password.
• Google Workspace: in the Admin console, open the user, reset the password, then reset their sign-in cookies.

If you can't sign in at all, call your IT provider and ask them to do it. If you don't have one, Microsoft and Google both have account recovery for administrators; start from the support page on their own website, never from a link in an email.

3. Check how the account signs in. Look at the sign-in methods on the account: phone numbers, authenticator apps, security keys. Attackers add their own so they can get back in after a password change. Remove anything you don't recognize, then set up multi-factor authentication again from scratch.

Ten to thirty minutes: find what they left behind

Attackers rarely just read. They set the mailbox up to keep working for them.

4. Delete inbox rules you didn't create. This is the step most people miss. A typical rule takes any message containing "invoice," "payment" or "wire," moves it to a folder you never open, and marks it as read. That's how a client's "did you really change your bank details?" never reaches you. In Outlook on the web, look under Settings, Mail, Rules. In Gmail, look under Settings, Filters and Blocked Addresses.

5. Turn off forwarding. Check whether the mailbox sends a copy of everything to an outside address. In Outlook: Settings, Mail, Forwarding. In Gmail: Settings, Forwarding and POP/IMAP.

6. Remove apps and people that shouldn't have access. Look at the apps connected to the account and remove any you don't know. An app that was given permission to read your mail keeps it after a password change. Check too for anyone added as a delegate on the mailbox.

7. Read your Sent and Deleted folders. Write down what went out in your name, to whom, and when. Look hardest for anything about payments, bank details or invoices, and for messages carrying a link to a "shared document." Those links are how an attacker moves from your mailbox into your clients'.

Thirty to sixty minutes: stop the damage spreading

8. Phone anyone who was asked to pay or to change payment details. Use a number you already hold. Not email, and not a number taken from a recent message.

9. If a payment went out, call the bank before anything else. Say it was fraud and ask for a recall of the transfer. Then file a report at ic3.gov with the full transaction details. Speed is everything here. In 2025 the FBI's recovery team froze $679 million of the $1.16 billion in fraudulent transfers it was asked to act on, a 58% success rate, and its guidance to victims is to contact the bank immediately (FBI Internet Crime Report, 2025).

10. Warn the people in your address book. A short, plain message from the secured account works best:

Between [date] and [date], someone gained access to my email account. If you received a message from me in that time asking for a payment, a change of bank details, or to open a link or document, please don't act on it. If you already have, call our office on [number]. The account is now secure.

Don't wait until you know everything. A prompt, calm notice costs you less with clients than silence followed by a surprise.

11. Call your cyber insurer. Do it before you hire anyone. Most policies require prompt notice, and many expect you to use their lawyers and investigators. Calling late, or hiring your own first, can put the claim at risk.

12. Keep the evidence. Take screenshots of the rules and messages before you remove them. Ask whoever handles your IT to export the sign-in and activity records today. They're only kept for a limited time, and they're the one way to show what the attacker did and didn't open.

Before the day ends: who do you have to tell?

A hacked mailbox is more than an embarrassment. In law, it may be a data breach.

Think about what sits in a partner's mailbox: tax returns, engagement letters, bank details, copies of ID sent for onboarding, medical records in a claim file. In Florida, unauthorized access to electronic data that holds personal information starts a 30-day clock for notifying the people affected. We set the rule out in Florida's data breach law.

Your profession adds its own duties. Lawyers owe clients confidentiality and prompt communication; see what the Florida Bar expects. Tax and accounting practices fall under the FTC Safeguards Rule, which has a 30-day report of its own.

This is where the records from step 12 earn their keep. With them, you can show the attacker opened forty messages. Without them, you have to assume everything was read, and notify on that basis. Get advice from a breach lawyer; your insurer will usually supply one.

How they got in

It was almost certainly one of three things:

• A reused password. The one on your email was also used on a website that was breached. See passwords on the dark web.
• A fake sign-in page. A link in a convincing email led to a page that looked like Microsoft or Google. The better ones pass your password and your one-time code to the real site as you type, and keep the session for themselves.
• An approval you didn't mean to give. A sign-in prompt arrived on your phone and got tapped.

If nothing changes, the same method works again next month, on you or on the person at the next desk.

What stops the next one

• Stronger sign-in. Multi-factor authentication on every account, using methods that can't be relayed through a fake page, and rules that refuse sign-ins from devices the firm doesn't manage. See why MFA comes first and which Microsoft 365 license a firm needs.
• Email filtering that opens the link before your staff do. See email security.
• Someone watching the account. A new forwarding rule, a sign-in from another country, an unfamiliar app given access: when an account is monitored, each of those raises an alert within minutes. When it isn't, you find out because a client calls. See Microsoft 365 and Google Workspace.

What this costs, against what it prevents

No provider can promise you'll never be hacked, and you should be wary of one who does. What a monthly fee buys is a smaller problem, caught sooner, and someone to call who already knows your systems.

	What it comes to
Our Business plan for ten people	$1,490 a month, $17,880 a year, with email security, account monitoring and staff training
Average reported loss to email payment fraud	About $123,000. The FBI counted $3.05 billion lost across 24,768 complaints in 2025.
Your own time	Two days of a partner's week on the phone to the bank, the insurer and clients, at your billing rate
If personal information was exposed	A lawyer, an investigation, notification letters, and penalties of up to $500,000 in Florida if the notice is late
What no invoice shows	The client who says nothing and quietly moves their work

Seen as a bill, $1,490 a month is easy to resent. Seen as the price of not having the hour you've just had, most owners would rather pay it every month and never find out what it saved them.

If this is happening to you right now

Work through the steps above and call your insurer. If you don't have an IT provider, your insurer's breach line is the fastest route to qualified help. We don't run an emergency line for firms we don't yet look after, and we'd rather tell you that than cost you an hour.

Once it's contained, book a free review. We'll go through what happened and what would have caught it. To be ready for a different kind of bad day, print the first hour of a ransomware attack and the payment change verification procedure.