If an email account has been hacked, the first job is to change the password, sign out every open session and delete any forwarding rules the attacker left behind. Next, review what was sent from the account, phone the companies you deal with to warn them about fake payment instructions and, if personal data was exposed, work to the 72-hour breach notification window. Keeping to that order limits the damage considerably.
Key takeaways
- Cut off access first: a new password alone is not enough, every open session on every device has to be closed.
- Attackers often leave hidden forwarding and deletion rules, so correspondence can keep leaking after the password changes.
- In the Verizon 2026 DBIR, use of stolen credentials held steady as an action in 36% of breaches.
- Fake bank-detail emails may already have gone out; warn contacts by phone on a known number, not by email.
- Where personal data is affected, Turkey's KVKK expects the Board to be notified within 72 hours of becoming aware of the breach.
How can you tell an email account has been compromised?
A compromised business mailbox often goes unnoticed for weeks, because the attacker deliberately stays quiet. The first sign usually comes from outside, such as a customer ringing to ask whether yesterday's new bank details are genuine.
The most common warning signs are:
- Messages in Sent Items that you did not write, or bulk sends to people you do not know.
- Emails marked as read that you never opened, or reply chains with gaps in them.
- A forwarding address you did not set up, or a rule that deletes messages containing certain words.
- Sign-in alerts from an unfamiliar country or device, or a password or signature that changed on its own.
Most accounts fall to a password typed into a fake sign-in page or reused from a leaked website (the method behind credential stuffing attacks); how staff can recognise such pages is covered in how to spot phishing emails.
What does a compromised mailbox cost a business?
The real cost is rarely the account itself; it is the fraud carried out through it. The attacker reads the correspondence, finds a payment that is about to fall due and sends an "our bank details have changed" message from inside the genuine thread. This pattern is known as business email compromise (BEC).
According to the FBI's Internet Crime Complaint Center (IC3), 24,768 business email compromise (BEC) complaints in the US reported total losses of $3.05 billion in 2025. (FBI IC3 2025 Internet Crime Report)
Credential theft remains just as widespread. In the Verizon 2026 Data Breach Investigations Report, use of stolen credentials held steady as an action in 36% of breaches. The Microsoft Digital Defense Report 2025 adds that more than 97% of identity attacks are password attacks, and that phishing-resistant multi-factor authentication can stop over 99% of them.
There is regulatory cost too: customer correspondence, ID copies and payroll attachments are personal data, and their exposure can amount to a data breach.
Which steps should you take, in order, in the first 24 hours?
Acting at random in a panic destroys evidence and buys the attacker time. Follow this sequence:
- Cut off access. Change the password to a long one that is not used anywhere else, and sign out every open session on every device. If the incident began with a missing device, follow closing sessions on a lost phone.
- Clear rules and forwarding. Check automatic forwarding, inbox rules, signature, reply-to address and out-of-office settings one by one; screenshot anything unfamiliar before deleting it.
- Preserve the evidence. Export sign-in logs, suspicious sent messages and their timestamps. Do not empty the Deleted Items folder.
- Review what was sent. List which recipients the attacker wrote to and about what. Flag every thread that mentions payments, bank details or invoices.
- Warn your contacts. Ring affected customers and suppliers on numbers you already hold, and tell them to ignore any new bank details received by email. If money has left the business, call your bank immediately. Urgent payment requests sent in an executive's name are another common follow-on; see our CEO fraud guide.
- Establish the scope. Check whether the same password is used on other systems and which shared mailboxes the account can reach.
- Decide on notification. If personal data is involved, start the notification assessment with your legal adviser and data protection lead.
The first two steps belong in the first hour; keep a written record of who did what, and when.
What might the attacker have changed in the account?
Attackers know the password will be reset, so they change settings to keep access and cover their tracks.
| Check | What to look for | Why it matters |
|---|---|---|
| Forwarding | Automatic forwarding to an external address | Mail keeps leaking after the password change |
| Inbox rules | Rules that delete or move messages containing "invoice", "payment" or "bank details" | A suspicious reply from a customer never reaches you |
| Open sessions | Unrecognised devices, locations or apps | The attacker can stay signed in without the password |
| Connected apps | Third-party apps granted mailbox access | They provide access without needing a password |
| Signature and reply-to | A changed phone number or a different reply-to address | Replies go straight to the attacker |
| Shared mailbox access | accounts@ or sales@ mailboxes the account can open | The scope of the damage widens |
If shared mailbox passwords are passed around a team, one compromised account puts every one of those mailboxes at risk. We set out a per-person permission model in our guide to mailbox permissions and delegation.
Do you need to tell customers, your bank and the regulator?
If the mailbox holds personal data and that data has been obtained by unauthorised people, a notification duty may arise under Turkey's Personal Data Protection Law No. 6698 (KVKK). Under Board Decision 2019/10, a data controller must notify the Board without delay and within 72 hours at the latest after becoming aware of the breach. For an hour-by-hour plan, see our guide to data breach notification under KVKK.
If money has moved, your bank and the police are separate contacts, and the chance of recalling a transfer is far higher in the first few hours. The full payment-diversion scenario is covered in bank detail change email fraud.
How do you stop the account being taken over again?
Once the incident is closed, permanent measures stop the same weakness being used twice.
- Multi-factor authentication: with MFA switched on, a stolen password is not enough on its own; the options are in our guide to multi-factor authentication for business.
- Unique passwords: a separate, long password for every system, held in a company password manager; see business password security.
- Shared mailboxes without shared passwords: everyone should open shared addresses with their own identity, and nobody should be given the mailbox password.
- Leaver discipline: a departing employee's access should be closed on their last day; the steps are in offboarding email access.
- Domain protection: SPF, DKIM and DMARC records make it harder to send fake mail in your domain's name; for the basics, read SPF, DKIM and DMARC explained.
A short staff session after the incident also pays off; see our security awareness training programme guide. More guides on related topics are collected under security and data protection.
How does SmartMail make this easier?
The SmartMail business email service, developed by Digital Bridge, brings several of the response steps above into one panel. Take a scenario: Ayşe in accounts typed her password into a fake sign-in page, and the next day a customer asks about a "change of bank details" email sent from her address.
- Cutting access from one place: in SmartMail, open sessions are listed with device details and can be closed remotely; when the password changes, sessions on every device are closed automatically. A session is also tied to the organisation address used to sign in.
- No shared mailbox password to leak: Ayşe opens the
accounts@mailbox with her own identity; the system generates the mailbox password, stores it encrypted and never hands it to staff. Access to the mailbox can be removed from a single screen, and scheduled emails are checked again at the moment of sending. - Seeing what happened: the audit log records actions such as granting access, changing settings and adding sender rules, with the person, time and IP address. A per-message activity history shows who read which email, which makes it easier to establish the scope for a breach assessment.
- Catching the fake instruction: every incoming email is checked for SPF, DKIM and DMARC, lookalike domains and display-name impersonation, and signs of a fake supplier, such as a bank-detail change, are flagged with a written reason.
Sign-in screens are also protected by Smart360 Security's human verification, which guards against automated password-guessing attacks. SmartMail does not replace human caution against phishing, but during an incident it lets you answer "who did what, and when?" from records rather than guesswork. Full details are on the SmartMail product page.
How can Digital Bridge help?
Digital Bridge supports both the incident response and the set-up that follows. Through our cyber security consultancy, log review, a check of your domain authentication records and a rebuild of the permission structure are planned together.
For the personal data side, our data protection compliance team helps with the notification assessment and with putting an incident procedure in writing. If a move to SmartMail is planned, preparing the DNS records and migrating old mail during the initial set-up are part of the same process.
What is the next step?
If you have not had an incident yet, test the seven steps in this guide against your own system: can you close sessions remotely, remove shared mailbox access from one screen and work out from the logs who did what? The full list of baseline controls is in our SME cyber security checklist.
If you want one panel that answers those questions, explore the SmartMail product page and, to buy SmartMail, use the Smart360 purchase page. If you need help with a live incident, get in touch through our contact page.