A compromised business inbox is one of the most common ways companies lose money, data, and trust — and one of the most fixable, if the first hour is handled right. Attackers who get into a business email account usually aren't there to read old messages; they're looking for invoices to redirect, credentials to harvest from trusted contacts, or a foothold into other connected systems.
What happens in the minutes and hours after you notice something is wrong matters more than almost anything else in the incident. Here's the order that actually limits the damage.
1. Lock the Account Down Immediately
Before anything else, change the password from a device you're confident is clean, and sign out of every active session everywhere the account is logged in. Most business email platforms have an admin option to force a global sign-out, which cuts off the attacker's access even if they're mid-session. Turn on multi-factor authentication at the same time if it wasn't already on — a new password alone doesn't help if the attacker still has a valid session token.
Do this first: force sign-out on all devices, reset the password, and enable MFA, in that order, within minutes of suspecting a compromise.
2. Assess What the Attacker Could See
Once the account is locked down, the next question is what the intruder actually had access to while they were in. Check the mailbox's sent folder, filters, and forwarding rules — attackers commonly set up a silent auto-forward to an external address so they keep reading mail even after the password changes. Review login history and IP addresses for anything unfamiliar, and take note of any sensitive threads, attachments, or financial conversations that were sitting in the inbox.
Why it matters: knowing exactly what was exposed determines who needs to be notified and whether financial fraud attempts are already in motion.
3. Notify the People Who Need to Know
If the compromised account touched client communications, vendor invoices, or payment requests, those contacts need a heads-up before an attacker sends them a convincing follow-up from a trusted name. Internally, loop in IT or your security lead, and if the business handles regulated data, check whether the breach triggers a legal notification requirement. A short, direct message beats silence — people who were in that inbox's contact list deserve a warning before they see a suspicious invoice land in their own inbox.
Do this first: notify anyone who exchanged financial or sensitive information with the account before the news has a chance to travel the wrong way.
4. Clean Up and Re-secure Every Connected System
Email is rarely the endpoint — it's usually the key to other things. Check for any new mail forwarding rules, mailbox delegates, or connected third-party apps that were authorized without your knowledge, and revoke anything unfamiliar. If the same password was reused anywhere else, that account needs a new one too. Review any systems that reset passwords via email, since an attacker with inbox access can often chain that into other accounts.
Why it matters: a breach that started in email and got cleaned up in email, but nowhere else, tends to reopen somewhere else within weeks.
5. Put Safeguards in Place So It Doesn't Happen Again
Most business email compromises trace back to a phishing link, a reused password, or the absence of multi-factor authentication — all of which are fixable before the next attempt, not just after this one. Multi-factor authentication should be mandatory for every account, not optional per employee. Regular phishing-awareness training and simulated tests catch the human side of the problem, and a written incident-response checklist means the next compromise — if there is one — gets handled in minutes instead of relearned from scratch.
Do this first: make MFA non-negotiable across every account, and write down the steps from this list so nobody has to reconstruct them under pressure.
The Underlying Pattern
Every one of these steps is about narrowing the window an attacker has to act and the number of places they can act in. Locking the account stops new activity, assessing exposure tells you what already happened, notification stops the damage from spreading to other people, cleanup closes the side doors, and prevention shortens the response time next time.
None of it requires exotic security tools — it requires acting on the assumption that a compromised inbox is a foothold, not just an inconvenience, and treating the first hour with the urgency it deserves.
About the Author
I'm Alex Susanu, an IT Consultant focused on helping businesses and professionals navigate technology and solve real-world IT challenges.
🌐 Learn more about my work: https://alexsusanu.com/
Top comments (0)