What to Do When an Employee's Email Account Is Hacked: A 6-Step Response Plan

Published by Aqib Muhammed, CEO

A colleague's work email has been taken over and everything seems urgent. Knowing what to do when an employee's email account is hacked comes down to order and the first ten minutes matter most.

Those moves buy you time. The six steps below finish the job.

Do these three things before reading on:
- Call the employee. Don't email them, whoever is in their inbox may be reading along
- Block the account or reset its password from a device you trust
- Ask finance to hold any payment requested by email today
- Switch to Email Check & Data Breach Monitoring Platforms

Why a hacked employee email puts the whole company at risk

A hacked employee email puts the whole company at risk because a work inbox is a trusted identity, not just a mailbox. Whoever controls it can email as a real colleague, read years of mail and reset passwords for other work tools.

Risk	What it looks like
Payment fraud	A fake invoice or "new bank details" from a real colleague's address
Exposed data	Customer, staff or financial records in the mailbox
Access to other tools	Password resets for payroll, cloud storage or sales tools sent to the hacked inbox

This is not hypothetical. In July 2026,Bank of Baroda confirmed that a compromised employee email account led to unauthorised access to certain bank data, while stating its core banking systems were not affected

The first three steps contain today's damage; the last three fix the cause

Key takeaway: treat a hacked employee email as a company incident from the first minute, not an IT ticket.

Every risk needs the attacker to keep access, so the first job is shutting every way back in.

Lock the attacker out of the employee's email account

To lock an attacker out of a compromised email account, block or reset the account, sign out every session and remove anything the attacker added to get back in.

Ask the employee whether they typed their password into anything recently or installed anything new.
Block sign-in or suspend the account. If you can't, reset it to a new, unique password from a device you trust, not the employee's laptop.
Sign out all active sessions. A session is the "already logged in" pass a browser keeps; a new password does not always cancel it.
Remove any multi-factor authentication (MFA) method the employee doesn't recognise, such as an unfamiliar phone number.
Delete inbox rules and forward the employee didn't create. An inbox rule is an automatic instruction attackers use to copy or hide incoming mail.
Revoke third-party apps given access to the mailbox and any app passwords.
If the account has admin rights, check what else it could have changed.

Resetting only the password is like changing the lock and leaving spare keys under the mat. Forwarding rules, connected apps and extra MFA phones are those keys.

Warning: if the employee's laptop or phone might have malware, a new password can be stolen the moment it is typed. Reset from a different device and have theirs checked first.

Where to find these settings in Microsoft 365 and Google Workspace

Action	Microsoft 365	Google Workspace
Block access	Disable the account in the Microsoft Entra admin center	Suspend the user in the Admin console
Sign out sessions	Revoke sign-in sessions in Entra	Reset sign-in cookies in the Security panel
Check MFA	Review authentication methods in Entra	Review 2-Step Verification
Rules and forwarding	Forwarding in the Exchange admin center; inbox rules, including hidden ones, in Exchange Online PowerShell	Forwarding and Filters tabs in the user's Gmail settings
Connected apps	Review user consents and app passwords	Revoke app access tokens and app passwords

If you want to know more about this, full vendor checklists are available on Microsoft Learn and Google Workspace Admin Help.

Next, check what went out while the door was open.

Check what the attacker sent and stop payment fraud

Check Sent Items, Deleted Items and your provider's message trace for anything the employee didn't send. The costliest damage is usually a fake invoice or bank-detail change from an address finance trusts.

Picture finance paying a vendor into a new bank account because the sales manager's real inbox asked them to. The sales manager never wrote it. This is business email compromise (BEC): fraud using a real or lookalike business inbox to request payments.

Look for

Emails mentioning payments, invoices or bank details
Replies slipped into existing vendor or customer threads
Links or attachments sent to many contacts at once
Items in Deleted Items the employee didn't delete

Warning: confirm every bank detail change made this week by calling the vendor on a number you already had, never one from the email.

If money has already gone, ask your bank to hold the transfer straight away, then report it to the police or your national cybercrime reporting channel.

What you find here decides who you now need to tell.

Tell the right people within the reporting deadlines

Tell leadership and finance within the hour and everyone who received a fraudulent email the same day. Then check your reporting duties. Some cyber security agencies expect a report within six hours.

Who	When	How
Leadership and finance	Within the hour	In person or by phone
People who got fraudulent emails	Same day	By phone or another channel, naming the time window to ignore
Your national cyber security agency	Within hours, if its rules cover your organisation	Its incident reporting form
Your data protection regulator	Commonly within 72 hours, if personal data was exposed	The regulator's breach form
People whose personal data was exposed	Without undue delay	Directly, in plain language

Whether one hacked mailbox is reportable depends on what it held and where you operate, so get legal advice the same day.

Next comes the part that stops a repeat, working out how they got in.

Find out how the attacker got the employee's password

Attackers usually get into a work email account in one of the four ways below. Until you know which, the same way stays open.

How they got in	Clues	What to fix
Phishing page	A "re-verify" or "shared document" email, then an unfamiliar sign-in	Phishing-resistant MFA and a team refresher
Password reused from another breach	Same or similar password used elsewhere; address in known breach data	Unique passwords and a check of the whole team
Infostealer malware, which copies saved passwords and sessions from a browser	Sessions despite MFA; recent pirated software	Clean the device and reset every password saved in it
Device left signed in	Sign-in from a known office device at an odd hour	Screen locks and a device policy

Verizon's 2026 Data Breach Investigations Report (DBIR) found software flaws were the way in for 31% of breaches, ahead of stolen or reused passwords at 13%. That is still roughly one breach in eight.

If the answer is a reused password from an old breach, the problem is bigger than one inbox.

Check whether other employees' email accounts are exposed

If the password leaked in another site's breach, other people from your company were probably on that site too, since work addresses get used for event passes, trials and newsletters, then forgotten.

These forgotten sign-ups are ghost accounts: old accounts tied to a work address that nobody recalls opening.

How one forgotten sign-up can lead to a hacked work inbox

To check the exposure:

Check every company email address against known breach data, not just the hacked one.
Ask staff which outside sites they joined with work email and close the ones they don't use.
Reset passwords for anyone whose address appears in a breach.

This closes today's gaps. What comes next keeps them closed.

Keep every employee's email account protected from now on

Close the way you found earlier, then raise the floor for everyone and keep checking the Identity Theft Resource Center tracked 1,803 data compromises in the first half of 2026 alone, about ten every day.

MFA on every mailbox, using authenticator apps or security keys rather than SMS codes
Alerts or blocks on automatic forwarding to outside addresses
A password manager, so unique passwords are realistic
Work email for work sites only
Closing accounts for leavers and unused software trials

Checking every address against new breaches is the hardest part to keep doing by hand and it is the job Shield by Synctric is built for.

Shield feature	What it does for you
Continuous breach monitoring	Checks enrolled work addresses against known breaches around the clock
Breach alerts	Alerts you through more than one channel when an address appears in a breach
Ghost account discovery	Surfaces old logins still tied to each address, including ones the employee has forgotten
Bulk user management	Adds employees in bulk and groups them by team or department
Admin dashboard	Shows company-wide exposure in one place

Setup means adding your team's addresses and choosing how you want to be alerted.

To keep that check running without manual work, see how Shield monitors your team's work email addresses.

Mid-incident and want to talk? contact our team

FAQs

How can you confirm an employee's email has really been hacked?

Look for sent emails the employee didn't write, rules or forwarding nobody set up and unfamiliar sign-ins. One odd sign-in can be travel; two signs together mean to treat it as a hack.

Should you delete the hacked email account?

No, suspend it. Deleting it can wipe the mail and sign-in history you need to investigate and report.

When can the employee use the email account again?

When the checks are done, not after a set wait. To recover a hacked email account fully, finish the lock-out (sessions, rules, apps and login methods) and check the employee's device. Then set a new, unique password and MFA before lifting the suspension.

What should the employee do once they are back in?

Change the old password anywhere else it was used, starting with personal email and banking. Then confirm the recovery phone number and backup email are their own and report any unexpected sign-in alerts or odd replies over the next few weeks.

Can attackers still send emails as the employee after the account is secure?

Not from the real inbox, but they can fake it. Domain authentication, set up with your email provider, makes other servers reject mail that spoofs your exact address. It can't stop lookalike domains, so keep confirming payment requests by phone.

How can you tell if the attacker is still in the account?

Watch for the warning signs coming back over the next few weeks . New inbox rules or forwarding, unfamiliar sign-ins or MFA prompts the employee to not trigger. If any appear, suspend the account again and recheck its connected apps and the employee's device.