Business Email Hacked? What to Do in the First Hour (Microsoft 365 & Google)

Business email hacked? Do these 6 things now

Work from a clean device (not the one you think was compromised) and sign in as an administrator, not as the affected user.

1. Block or reset the account. Microsoft recommends disabling the account during the investigation if you can; otherwise reset the password straight away. Google recommends suspending the user first. Use a new, strong password and do not send it to the user by email.
2. Sign the user out everywhere. A password reset alone does not always end sessions that are already open. Revoke sessions in Microsoft 365, or reset sign-in cookies in Google Workspace.
3. Turn on MFA and remove unknown MFA methods. Attackers often register their own phone or authenticator app.
4. Remove forwarding and inbox rules that send copies of email elsewhere or hide replies. Details below.
5. Revoke app access and app passwords. Connected apps and app passwords can keep working after a password reset.
6. Warn your contacts. Tell customers, suppliers and your bank not to act on any payment-change request from that mailbox without calling you first.

Signs your Microsoft 365 or Google account is compromised

Microsoft's guide to compromised email accounts lists the common symptoms. The ones small businesses usually notice first:

• Customers reply to emails you never sent, often about invoices or new bank details.
• Messages in Sent Items or Deleted Items that you do not recognise.
• Inbox rules that forward mail to unknown addresses, or move messages to folders such as RSS Subscriptions, Notes or Junk Email.
• The mailbox is suddenly blocked from sending email.
• Unexpected password-reset emails, MFA prompts you did not trigger, or unexplained lockouts.
• A changed email signature or new external forwarding.

Check for hidden forwarding and inbox rules

This is the step most people miss. Attackers commonly set a rule that forwards invoices to themselves, or moves replies from your accountant into an obscure folder so you never see them. The account stays useful to the attacker even after you change the password.

Microsoft 365

• In the Microsoft 365 admin centre, open Users > Active users, select the person and check Mail > Email forwarding. Turn off any forwarding you did not set up.
• In Outlook on the web, go to Settings > Mail > Rules and delete anything unfamiliar.
• Some rules can be hidden from Outlook. Microsoft documents how to list them with Exchange Online PowerShell using Get-InboxRule with the -IncludeHidden parameter, and how to check mailbox-level forwarding with Get-Mailbox.
• Check whether anyone has been given delegate or full access to the mailbox.

Google Workspace

• In Gmail, open Settings > See all settings > Forwarding and POP/IMAP and remove any forwarding address you did not add.
• Check Filters and Blocked Addresses for filters that forward, delete or archive messages.
• Check Accounts > Grant access to your account for delegates you do not recognise.
• In the Admin console, review the user's recent sign-ins in the audit logs. Google's guide to identifying and securing compromised accounts lists the logs to check.

Revoke sessions and app consents

Attackers increasingly avoid passwords altogether: they steal a session token, or trick the user into approving a malicious app that can read mail. Changing the password does not remove either.

Microsoft 365

• Use Sign out of all sessions on the user's page in the admin centre, or revoke sign-in sessions as described in Microsoft's emergency access revocation guide.
• In the Microsoft Entra admin centre, review the user's registered MFA methods and remove any they do not recognise.
• Review Enterprise applications and remove consent for apps that should not have access.
• Check whether the user has been given any admin roles, and remove any that should not be there.
• Delete app passwords. Microsoft notes they are not revoked automatically when you reset the password.

Google Workspace

• In the Admin console, open the user's Security panel and reset sign-in cookies. Google says it can take up to an hour to sign the user out of current Gmail sessions.
• Revoke OAuth tokens for connected apps you do not trust, and remove any app passwords.
• Check the user's mobile devices and wipe any you do not recognise.

Review the sign-in logs to establish when the attacker first got in, from where, and what they accessed. Write this down with times. You will need it for the PDPA assessment and for your bank or insurer.

Warn customers about fake invoices

The real damage from a hacked business mailbox is usually invoice fraud. The attacker reads your conversations, then sends a convincing message from your real address saying your bank details have changed. Your customer pays the wrong account.

Send a short, calm message to customers and suppliers you have recently invoiced or paid:

• Say that your email account was accessed without permission on a given date.
• Ask them to ignore any request to change bank details or pay a new account.
• Ask them to confirm payment details by phone using a number they already have, not one in the email.
• Tell them how to reach you if they have already paid.

Do the same internally. Your own finance staff should check any supplier bank change by phone, every time, from now on.

Is it a PDPA notifiable breach?

A hacked mailbox almost always contains personal data: customer names, phone numbers, addresses, NRIC copies, payslips or medical details. That makes it a data breach under the PDPA, and you must assess whether it is notifiable. This is general information, not legal advice.

Under the PDPC's guide on managing and notifying data breaches:

• A breach is notifiable if it is likely to result in significant harm to individuals, or affects 500 or more individuals.
• You should take reasonable and expeditious steps to complete the assessment, within 30 calendar days.
• Once you determine it is notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days.
• If significant harm is likely, you must also notify the affected individuals.

The PDPC has a free breach self-assessment tool and an online form to report a breach. Your DPO should lead this. If you do not have one yet, see how to appoint a DPO.

Report to your bank, the police and SingCERT

• Your bank: call the bank's official hotline immediately if any payment went to the wrong account, and ask them to try to recall it.
• ScamShield Helpline 1799: a 24/7 line that can help direct scam victims to their bank and advise on next steps (ScamShield). It cannot take police reports.
• Police report: file online through the SPF e-services police report. Banks and insurers often ask for the report number.
• SingCERT: organisations in Singapore can report cyber incidents to CSA's SingCERT using Cyber Aid, which covers phishing, scam emails, ransomware and more.
• Your insurer: if you have cyber insurance, notify them early. Many policies have short notice periods.

How to stop it happening again

Most business email compromises start with a stolen password and no MFA. Once the incident is closed:

• Enforce MFA for every account, not just admins. On Microsoft 365, security defaults are free and require everyone to register for MFA. On Google Workspace, you can enforce 2-Step Verification for your organisation.
• Block external auto-forwarding by default, and allow it only where there is a business need.
• Block legacy sign-in methods that bypass MFA.
• Turn on anti-phishing and impersonation protection for directors and finance staff.
• Use a password manager so staff stop reusing passwords.
• Check SPF, DKIM and DMARC so attackers find it harder to spoof your domain. Our free domain check shows your current setup in seconds.
• Agree a call-back rule: no change of bank details is ever accepted by email alone.

Do it yourself or get help?

If you are the admin and you are comfortable in the Microsoft 365 or Google admin console, you can do every step above yourself using the official Microsoft and Google guides linked in this article. Work methodically, write down times and what you found, and do not skip the forwarding rules and app consent checks.

If you are not the admin, cannot find the settings, or need to be sure the attacker is fully out, get help quickly. Our Hacked Email Recovery (S$290, fixed price, usually within 1 business day) signs the attacker out, forces MFA, removes hidden rules and suspicious app connections, reviews sign-in history and gives you a written timeline for your PDPA breach assessment. It does not include forensic work for court or recovering lost money; for that, go to your bank and the police first.

To close the gaps across the whole team afterwards, the Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users and adds anti-phishing and forwarding controls. We work remotely and in writing, using temporary admin access that is removed afterwards.