Blog

My Microsoft 365 or Gmail Email Was Hacked: What to Do in the First Hour

5 Min Read

TL;DR

  • Stop clicking around in that mailbox. If your Microsoft 365 or Gmail work email is hacked, the first hour is for five moves.
  • 1. Clean device + call IT. Use a different trusted device. For a work account, call your IT provider right away.
  • 2. Reset the password and revoke sessions. A password change alone is not enough while other sessions stay open.
  • 3. Check MFA. Remove any phone or authenticator you don’t recognize, then turn MFA on or set it up again yourself.
  • 4. Hunt persistence. Check forwarding, mailbox rules, filters, delegates, and connected apps. Revoke anything you don’t recognize.
  • 5. Warn contacts and finance. Pause payment-change requests, W-9 updates, or “new bank account” emails until someone confirms by a known phone number.
  • Book a free Discovery Meeting to review Microsoft 365 or Google Workspace email security: (843) 324-5824 or advyon.com/contact/.
Watch: My Microsoft 365 or Gmail Email Was Hacked: What to Do in the First Hour (3:19)

Most people change the password and hope that’s the end of it. In our YouTube video, Jason and Mabel walk through why that isn’t enough, and the five moves that matter in the first hour after a Microsoft 365 or Google Workspace work account is compromised.

What should I do first if my business email is hacked?

Stop. Don’t keep clicking around in that mailbox. The computer or phone you just used might still have the attacker’s session open.

Get to a different trusted device, or a known-good machine at the office. If this is a work Microsoft 365 or Google Workspace account, call your IT provider as soon as you suspect it. Admins can disable or suspend the account, revoke sessions, and read the sign-in logs. You don’t have to finish every step alone.

Is changing the password enough?

No. Reset it from that clean device, with a strong unique password you haven’t used anywhere else. Don’t email the new password to the hacked mailbox.

Then sign out everywhere, or have IT revoke active sessions. A password change alone is not enough. Sessions and refresh tokens can keep the attacker inside until someone ends them. The same idea applies if someone fell for device-code phishing and typed a code on a real Microsoft sign-in page: reset the password, then revoke the sessions.

What should I do about multi-factor authentication?

Check every MFA method on the account. Remove any phone number or authenticator you don’t recognize. Then turn MFA on if it isn’t already, and set it up again yourself. Attackers often add their own method so they can get back in after you change the password.

If your team still relies on text-message sign-in codes for Microsoft 365, that’s a weaker method, and Microsoft is ending those codes in 2027. After a compromise, re-enroll MFA yourself either way.

Where do attackers hide after a password reset?

In the mailbox and in the apps. Look for rules that send mail somewhere else, delete replies, or quietly move messages about invoices or passwords.

  • Microsoft 365: check mailbox forwarding and inbox rules, including ones that look empty or oddly named.
  • Google Workspace / Gmail: check forwarding, filters, and delegates.
  • Connected apps: review app consents and OAuth access. Revoke anything you don’t recognize.

These are the usual ways an attacker stays in after a password change. Clearing them is as important as the reset itself.

Who should I warn if a work email is hacked?

Your team, your vendors, and anyone who pays your invoices. Tell them to pause payment-change requests, W-9 updates, or “new bank account” emails until they confirm by a known phone number, not a number from the suspicious message. Check Sent mail for messages you didn’t write.

Business email compromise often starts with one mailbox and ends with a wire that never should have gone out. CISA advises verifying a change in payment instructions by calling a number from a known contact list, not from the email itself.

How can I tell if a Microsoft 365 or Gmail account was hacked?

You may not get a clear alert. These signs, drawn from Microsoft and Google guidance, are worth a closer look:

  • Mail you didn’t send, or messages that are missing or were deleted.
  • New forwarding, odd inbox rules or filters, or unexpected delegates.
  • Unrecognized MFA methods, devices, or connected apps.
  • Password changes, lockouts, or recovery phone and email changes you didn’t make.
  • The mailbox is suddenly blocked from sending.

If any of that looks familiar, treat the account as compromised and start the first-hour checklist.

The first-hour checklist

  1. Clean device and call IT for a work account.
  2. Reset the password from that clean device and revoke sessions / sign out everywhere.
  3. Check MFA methods, remove anything you don’t recognize, and turn MFA on.
  4. Check forwarding, mailbox rules, and connected apps, and revoke what you don’t recognize.
  5. Warn contacts and finance to pause payment-change requests until they confirm by a known phone number.

For a business account, call IT as soon as you suspect it. The five steps still matter, but IT can revoke sessions, review sign-in logs, and clean what a regular user can’t see.

Frequently asked questions

What should I do first if my business email is hacked?

Stop using the compromised session, get to a clean device, and call IT if this is a work account. Then reset the password and revoke sessions.

Is changing the password enough?

No. Also revoke sessions or sign out everywhere, check MFA methods, remove suspicious forwarding and mailbox rules, and revoke unknown connected apps.

What should admins do in Microsoft 365?

Reset or disable the account, revoke sessions, review MFA methods, remove forwarding and inbox rules, review app consents, and check sign-in logs. A regular user can’t see all of this.

What about Google Workspace or Gmail?

Reset the password, reset sign-in cookies or revoke sessions, revoke OAuth apps and app passwords, remove forwarding, filters and delegates, and enable 2-step verification.

Who should I warn?

Your team, vendors, and anyone who pays invoices. Pause payment-change, W-9, or new-bank-account requests until they’re confirmed by a known phone number.

How do I know if my Outlook or Gmail account is hacked?

Look for mail you didn’t send, missing messages, new forwarding or odd rules, unrecognized MFA methods or apps, and password or recovery-info changes you didn’t make.

Want a second set of eyes on your email security?

ADVYON has helped Lowcountry businesses with technology since 2008, from Summerville and Mt Pleasant. Book a free Discovery Meeting and we’ll walk through this checklist for your Microsoft 365 or Google Workspace setup. Call (843) 324-5824 or visit advyon.com/contact/. See our managed IT services and managed security services pages for how we work.

Sources

Educational information, not a guaranteed remediation, legal advice, or a security audit. Steps depend on your tenant setup and admin access. Sources checked Nov 10, 2026. The hosts in the video are AI-generated presenters.