Business email hacked? What to do in Microsoft 365 and Google Workspace

Signs it’s happened

• People reply to emails you never sent.
• Messages you expected never arrive, or go straight to an odd folder.
• Sign-in alerts from places you’ve never been.
• Your sent folder has messages you didn’t write, or is suspiciously empty.

Lock it down now

1. From a clean deviceUse a computer or phone you trust, not one that might be infected.
2. Reset the password and sign out everywhereIn Microsoft 365, an admin can reset the password and revoke sessions in the admin center. In Google Workspace, an admin can reset the password and sign the user out of all sessions.
3. Turn on two-step sign-inWith an authenticator app or passkey, and check the recovery phone and email haven’t been changed.
4. Remove forwarding and rulesLook in the mailbox settings for forwarding addresses and inbox rules you didn’t create, especially ones that move or delete messages with words like invoice, payment or wire.
5. Remove connected appsCheck third-party apps and add-ons that have access to the account, and remove any you don’t recognize.
6. Check for delegatesMake sure nobody new has been given access to the mailbox.

Then

• Check the sent folder and sign-in logs to see what was sent and when.
• Warn the people who received fake messages, by phone if money was involved.
• If money was sent, call the bank immediately and report it at ic3.gov.
• Set up DMARC so the next attacker can’t forge your domain from outside. See how to set up DMARC.
• If customer, patient or financial information was in the mailbox, talk to your attorney about notification duties.