Company email hacked — checklist

For owners · all guides

Customers say they got a weird message from you — or your Sent folder has mail nobody wrote. That often means a real account takeover, not only a forged From line.

Do this now

1. Lock the account / change the password from a clean device.
2. Sign out all sessions in Microsoft 365 or Google Workspace.
3. Turn on or verify MFA.
4. Check inbox rules and forwarding (silent forward rules are a classic).
5. Keep one original .eml of the suspicious message — do not open links.

Then

Check whether the domain blocks spoofing (DMARC). That alone does not remove a hacker, but it stops parallel forged senders.