In this guide · 8 sections
Short answer
Get help if you see forwarding or inbox rules you did not create, unknown connected apps, payment or invoice fraud, or several affected accounts, or if you cannot tell what was accessed. Call your bank first if money moved. CSA's Cyber Incident Helpline (6890 9555) offers free weekday triage.
First hour: do these before anything else
For the account itself, our hacked email first steps guide has the detailed clicks. In short:
Reset the password from a clean device
Use a different, trusted computer or phone. Microsoft advises not to send the new password by email, because the attacker may still be reading the mailbox.
Sign the attacker out everywhere
Revoke all sessions in the Microsoft 365 or Google admin console, so stolen session tokens stop working.
Turn on MFA
Enforce multi-factor authentication on the account, and remove any methods you do not recognise.
Warn people who may get fake emails
Tell finance contacts, key customers and suppliers by phone not to act on payment requests from that address until you confirm.
Do not delete anything yet
Leave suspicious rules, emails and logs in place until they are recorded. Deleting them destroys the evidence you need later.
Signs it is beyond DIY
Microsoft's guide to responding to a compromised email account lists the symptoms to look for. Several of them mean the attacker has set up ways to keep access or hide what they are doing.
| What you see | Why it matters |
|---|---|
| Inbox rules forwarding mail outside, or moving mail to RSS, Notes or Junk | Attacker hides replies and keeps reading mail after a password reset |
| External forwarding recently added | Copies of all mail go to the attacker |
| Unknown apps with mailbox permissions (OAuth consents) | Apps keep access without the password |
| App passwords on the account | Microsoft notes app passwords are not revoked by a password reset |
| Fake invoices or bank-change emails sent to customers | Possible fraud losses, and customers' trust at risk |
| More than one mailbox affected, or an admin account | Wider compromise; the attacker may control settings |
| Sign-ins from other countries over weeks | Long dwell time; more data likely accessed |
If you see any of these, or you simply cannot tell what the attacker did, a responder will save time and reduce the chance of missing something.
What a professional incident responder does
A good responder works through the account methodically and gives you a written record, not just a fixed password.
- Locks the attacker out: password reset, session revocation, MFA reset, removal of rogue MFA methods and app passwords
- Removes persistence: inbox rules, forwarding, delegated access, OAuth app consents and mail flow rules
- Reviews sign-in and audit logs to build a timeline of when the attacker got in and what they did
- Identifies which emails and attachments were read, sent or deleted, as far as the logs allow
- Checks other accounts for the same signs, especially finance and admin users
- Closes the gap they used, such as missing MFA or legacy sign-in methods
- Writes up the timeline so you can assess PDPA notification and support bank, police or insurance claims
Ask in advance what logs your licences keep. Audit log retention varies by Microsoft 365 and Google Workspace plan, so evidence from many weeks ago may already be gone.
Preserve evidence before you clean up
Banks, police, insurers and the PDPC may all ask what happened. Record before you remove.
Evidence to keep
The PDPA decision: do you need to notify?
A hacked mailbox usually contains personal data: customer names, phone numbers, NRIC copies, invoices. Under the PDPC's Guide on Managing and Notifying Data Breaches, once you have credible grounds to believe a breach occurred, you must assess whether it is notifiable within 30 calendar days. A breach is notifiable if it is likely to cause significant harm to individuals or affects 500 or more people. If it is, you notify the PDPC within 3 calendar days of that decision.
This is why the responder's timeline matters: it tells you what data the attacker could see and how many people are involved. Our guide to PDPA data breach notification walks through the tests. This is general guidance, not legal advice.
CSA helpline vs paid help
On 14 October 2026 CSA announced a Cyber Incident Helpline for organisations, run by the Cyber Resilience Centre, on 6890 9555. It helps organisations understand the next steps to contain an incident and begin recovery. Our helpline guide covers hours and what to have ready.
The free helpline is a good start when
- You are not sure whether you have an incident
- You want triage and next steps on a weekday
- You need referrals to the right agencies or providers
- You can do the technical fixes yourself with guidance
Paid hands-on help makes sense when
- Someone needs to log in and clean the tenant today
- Money has moved and you need a timeline for the bank or insurer
- Several accounts or an admin account are involved
- You need a written record for a PDPA assessment
If you have cyber insurance, call the insurer's hotline early. Some policies require notice before you engage responders, or provide their own.
Do it yourself or get help?
If a single mailbox was taken over, no rules or apps were added, no fraudulent emails went out and you have MFA on now, the DIY steps in our first-steps guide may be enough. Check every account afterwards and turn on MFA everywhere using our MFA set-up guide.
If any warning sign above applies, our Hacked Email Recovery (S$290) locks the attacker out, removes hidden rules and app connections, reviews sign-in history and gives you a written timeline for your PDPA assessment. It does not include court-grade forensics or recovering lost money. Afterwards, an Incident & Ransomware Response Plan (S$390) makes the next incident faster to handle.
Frequently asked questions
Often not. A password reset does not remove inbox rules, external forwarding, connected apps with mailbox permissions or app passwords, which Microsoft notes are not revoked by a reset. Attackers use these to keep access or hide replies. Check and remove them, revoke all sessions and turn on MFA.
CSA's Cyber Incident Helpline on 6890 9555, launched in October 2026, offers free triage and next steps for organisations. For hands-on clean-up, an IT or security provider can work in your Microsoft 365 or Google Workspace tenant. If money was lost, contact your bank and make a police report immediately.
Only if the breach is notifiable: likely to cause significant harm to individuals, or affecting 500 or more people. You must assess this within 30 calendar days of having credible grounds to believe a breach happened, and notify the PDPC within 3 calendar days of deciding it is notifiable.
Keep screenshots of suspicious rules and forwarding settings, exports of sign-in and audit logs, a list of connected apps before removal, copies of fraudulent emails with headers, notes of who noticed what and when, and reference numbers from your bank, the police and any helpline.
No IT service can reverse a bank transfer. Only your bank can try to recall a payment, and speed matters, so call them first. What a responder can provide is a clear timeline and evidence of how the fraud happened, which your bank, the police and your insurer may ask for.