Here is how it usually goes. Someone in the office gets an email that looks like a Microsoft sign-in page, types their password, and thinks nothing of it. A day later a customer calls asking about a strange invoice. Somebody realizes they have had their email hacked, the password gets changed that afternoon, and everyone goes back to work.
Then on Thursday another customer calls about the same kind of message. The password was changed on Monday. So how did they get their email hacked twice in one week?
When you have your email hacked, changing the password is the right first move. It is just not the last one. While someone was inside the mailbox, they had time to leave things behind that do not care what the password is now. Let me walk through what those things are, in the order we usually find them, and what to do about each one.
Email hacked? Here is what the new password actually fixes
A new password stops one thing: someone signing in fresh with the old password. That matters. It is still only one door.
Think about what you do every morning. You open Outlook and your email is just there. You did not type a password. The first time you signed in, the email service handed your computer a kind of pass that says “this person already proved who they are.” That pass is called a session, and it can keep working for a while after the password changes.
If someone got your email hacked from their own computer, they are holding one of those passes too. Google says changing your password signs you out of most places, and then lists the exceptions in its help page on password changes. Microsoft is blunter about business accounts. Its guide to responding to a compromised email account tells administrators to block the account and end active sessions as separate steps, on purpose.
The password also does nothing about settings. Anything the attacker changed inside the mailbox stays changed until a person finds it and undoes it. That is where most of the trouble is.
Email matters more than most accounts because it is where every other password reset goes. Your accounting software, bank portal, file storage and social media all send their reset links to your inbox. So getting your email hacked can quietly become getting everything else hacked. The UK’s National Cyber Security Centre makes the same point in its advice on hacked accounts.
7 hidden ways they keep access after you get your email hacked
Most of the businesses we work with run Microsoft 365, so I will describe these the way they look in Outlook. Google Workspace has the same pieces under different names.
1. A session that is still signed in
This is the pass from earlier. If the attacker signed in through a browser or the Outlook app, that session may still be valid. Some phishing pages are built to steal the pass itself, not just the password, which we explain in our post on session hijacking.
The fix is an administrator ending every session on the account. Microsoft calls it revoking sessions. Google calls it resetting sign-in cookies. Your phone might call it signing out of all devices. If the employee’s own computer might have something nasty on it, start the cleanup from a different computer and have that one checked before they sign back in.
2. A forwarding rule
This is the one we find most often when a business has had their email hacked. The attacker sets up a rule that quietly sends a copy of every new message to an outside address. The employee never sees it.
The smarter version only forwards some messages. Anything with “invoice,” “payment,” “wire,” or “password reset” in it goes out. Everything else stays put, so nothing looks wrong. Microsoft and Google both tell you to check forwarding after a break-in, in Microsoft’s forwarding guidance and Google’s Gmail security tips.
3. A rule that hides things
Rules are not only for sending email out. They can also move email out of sight. Attackers have been known to set up rules that take every reply from a specific customer and drop it straight into a folder nobody opens, so the customer’s “did you really change your bank details?” never gets read.
Here is the part people do not expect. Some of these rules can be hidden from the normal Outlook settings screen. So the employee checking their own rules and finding nothing is not proof of anything. Microsoft recommends an administrator review every rule from the admin side, hidden ones included.
4. A connected app
You have probably clicked “Allow” on a screen that said an app wants to read your mail, see your calendar, or sign you in. That approval is called OAuth. It gives the app its own key to your account, and that key does not change when your password does.
Attackers build apps with friendly names and real-looking logos, then trick someone into approving them. We have seen people get their email hacked through nothing more than one click on Allow. Microsoft’s guide to harmful app consent spells out what a bad approval can reach: email, files, contacts and forwarding rules. The name and logo prove nothing. Someone needs to look at who made the app and what it is allowed to do, then remove anything the business does not use.
5. Someone else with access to the mailbox
Business email lets one person open another person’s mailbox. An owner gives the office manager access, or three people share the accounts inbox. That is called delegation, and the person with access signs in with their own account.
So changing the mailbox owner’s password does nothing to them. If the attacker added an outside account as a delegate, or gave themselves “Send As” rights so they can send mail that looks like it came from you, that stays. Microsoft lists these permission types in its page on mailbox permissions. Every name on that list should have a reason to be there.
6. A recovery phone or sign-in method they added
While they were in, an attacker can add their own phone number, a backup email address, or their own authenticator app to the account. Later, they use it to approve a sign-in or reset the password right back. You change it Monday, they change it Tuesday.
This is how a lot of people get their email hacked a second time right after fixing the first. Pull up the list of sign-in methods and recovery details with the employee sitting there. If neither of you recognizes something, it goes.
7. Old app passwords
Some older programs and printers that send email use a separate “app password” instead of the real one. Microsoft notes these do not go away when the main password changes. Most offices have forgotten they exist.
Had your email hacked? Do these in this order
Some of what I just described only shows up in the Microsoft 365 or Google admin center. That is not something to hand to the employee and hope. Call whoever manages your email. Here is the order we follow.
Block the account first. The administrator temporarily turns off sign-in and ends every active session. The employee is without email for a bit. That is fine. Leaving it on gives the attacker more time to read, send and delete.
Then change the password. Use one that has never been used anywhere else. If the old password was reused on other accounts, those get changed too. And do not email the new password to the account that just had its email hacked. Call the person, or use a password manager.
Then clean out the mailbox. Forwarding, rules, connected apps, delegates, Send As rights, automatic replies, signatures, recovery details and sign-in methods. Every one, checked against what the employee actually set up.
Then find out what happened. Look through Sent, Deleted Items and Drafts for messages the employee did not write. The administrator should pull the sign-in history and start a few days before the first warning sign. When a client has had their email hacked, the real break-in is usually earlier than anyone thinks. A sign-in from a strange city is a clue, not proof, since phone carriers and VPNs move your apparent location around.
Then warn people. If messages went out under your name, call the people who got them, using a number you already have, not one from the email. Anything about bank details, invoices, payroll or gift cards gets a phone call today. If money already moved, call the bank right away. The Australian Cyber Security Centre has a good checklist for reviewing a hacked account if you want to compare.
Then hand it back, protected. Turn on multi-factor sign-in before the employee logs back in. That is the code or phone approval after your password. Better still are passkeys or a physical security key, because a fake login page cannot capture those the way it can capture a typed code.
One thing I want to be honest about. Multi-factor sign-in stops the next stolen password. It does nothing about the forwarding rule, the connected app or the extra delegate already sitting there. We see businesses turn it on after getting their email hacked, feel safe, and skip the cleanup. The rule keeps forwarding.
Keeping it from happening twice
The businesses that get their email hacked a second time almost always skipped one of these three settings. Your IT provider can turn them on in an afternoon.
First, block automatic forwarding to outside addresses unless your business has a real reason to allow it. If nobody can forward company email outside the company, the most common trick stops working. Second, limit which outside apps employees can approve on their own, so an admin has to say yes first. Third, require multi-factor sign-in on every mailbox, starting with the owner and whoever handles money.
Then tell your people what to report. An approval prompt on their phone they did not ask for. A “new sign-in” alert. A reply to a message they never sent. Those are the early signs of someone getting their email hacked, and a five-minute call costs a lot less than finding out from a customer. We cover the phishing side of this in our post on fake login pages that steal sessions, and spoofed email, which is a different problem, in our post on email spoofing.
Across Southeast Texas, most of the email hacked calls we get come from offices that never had anyone watching these settings. Keeping an eye on them is part of what our email security service does for clients.
Frequently asked questions
Got your email hacked? Does changing the password log them out? Not always. Some services sign out most sessions when the password changes, and some do not. An administrator should end every active session separately, every time.
Email hacked and the password changed, but strange messages are still going out. Why? Usually a forwarding rule, a hidden inbox rule, or a connected app. Have your administrator check from the admin center, because some rules do not show in the normal Outlook screen.
Can an app read my email without my password? Yes. An app you approved through a “this app wants access” screen keeps its own access. Remove any connected app the business does not recognize or use.
Should I delete the account after getting my email hacked? No. Block it while it gets cleaned up and investigated. Deleting it can erase the very records you need to figure out what happened and who got fake messages.
Is multi-factor sign-in enough once you have had your email hacked? It is necessary, but not enough by itself. It blocks new sign-ins with a stolen password. It does not remove rules, apps, delegates or recovery methods the attacker already added.
If you think someone may still have a way into your business email, do not wait on it. Our Cyber Shield guide walks through the settings that keep a mailbox locked down. If you would rather just talk it through, we are happy to.
Featured image: Pexels
