What To Do If a Business Email Account Is Compromised

A compromised business email account can create real pressure, especially if the account is tied to invoices, client communication, banking requests, Microsoft 365, or administrator access. The response should be calm, structured, and documented. The goal is to stop unauthorized access, understand what changed, reduce business impact, and prevent the same issue from happening again.

This guide is written for small businesses using Microsoft 365 or similar business email systems. It is not a substitute for incident response in a regulated environment, but it gives a practical starting point for the first hour and the follow-up work.

1. Secure The Account First

Start by blocking unauthorized access. Reset the password, revoke active sessions, and confirm multi-factor authentication settings. If the account has administrator privileges, treat the incident as higher risk because the attacker may have had access to more than one mailbox.

• Reset the account password
• Revoke sign-in sessions and refresh tokens
• Review MFA methods and remove suspicious methods
• Check recovery email, phone, and alternate sign-in details
• Disable the account temporarily if needed

2. Check Mailbox Rules And Forwarding

Attackers often create inbox rules that hide replies, forward messages, delete warnings, or move important conversations out of view. Check forwarding settings, inbox rules, sweep rules, delegates, shared mailbox access, and any suspicious filters.

Do not assume the account is clean just because the password was changed. If a hidden forwarding rule remains active, the attacker may continue receiving sensitive messages without signing in again.

3. Review Sign-In Activity

Look at recent sign-ins, locations, devices, browsers, and failed login patterns. In Microsoft 365, sign-in logs can help show whether the account was accessed from unusual locations or through older authentication methods.

Keep notes. Record the date and time of suspicious activity, what was changed, and what actions were taken. Documentation matters if clients, vendors, insurance, legal counsel, or leadership later ask what happened.

4. Assess Business Impact

The most important question is not only “was the account accessed?” It is “what could the attacker have done while inside?” Review sent mail, deleted mail, inbox rules, recent conversations, invoice threads, payment instructions, client files, and internal requests.

• Were fake invoices or payment changes sent?
• Were clients or vendors asked to change banking information?
• Were internal users asked to approve purchases or transfers?
• Were sensitive files downloaded or shared?
• Were other accounts reset using this mailbox?

5. Communicate Clearly

If suspicious messages were sent externally, communicate quickly and plainly. Do not over-explain or speculate. Tell affected contacts that the account was compromised, ask them not to open links or follow payment instructions from suspicious messages, and provide a safe way to confirm legitimate requests.

Internally, tell staff what to watch for. Attackers often use one compromised mailbox to target coworkers, especially finance, administration, leadership, and anyone who handles invoices or approvals.

6. Check Related Accounts And Devices

Email compromise can be a symptom, not the whole incident. Review the user’s device, browser extensions, password manager, cloud apps, and any third-party systems that use the email account for password resets. If the user reused passwords, prioritize high-value systems first.

7. Reduce Repeat Risk

After the immediate response, fix the conditions that made the compromise easier or more damaging. This may include stronger MFA, conditional access, disabling legacy authentication, better email filtering, security awareness training, admin role cleanup, and clearer payment verification procedures.

The goal is not to blame one user. Most email compromises succeed because the system allowed a small mistake to become a bigger business risk.

A Practical Next Step

If you suspect a business email account has been compromised, move in order: secure access, check mailbox changes, review sign-ins, assess business impact, communicate clearly, and then harden the environment. OnlineV can help Calgary businesses review Microsoft 365 security, email protection, MFA, mailbox rules, and recovery steps after an incident.