Microsoft 365 Email Hacked? What to Do in the First 24 Hours

A client calls to ask why you sent them a strange invoice. Your sent folder has emails you never wrote. You cannot log in, or you get a password reset you did not ask for. These are signs that a Microsoft 365 email account may have been compromised, and the first 24 hours matter. This guide gives you a clear, step-by-step response plan, and explains how to stop it happening again. If you need help right now, our 24/7 IT support team can step in.

Signs your email account has been compromised

• Contacts receive emails, invoices or links you did not send.
• Messages appear in your Sent Items or Deleted Items that you do not recognise.
• New inbox rules move, delete or forward emails without you knowing.
• You receive sign-in alerts or multi-factor prompts you did not trigger.
• Your password suddenly stops working.
• Replies from clients go missing, often because a rule is hiding them.

The first hour: contain the account

1. Reset the password from a clean device, not the computer you suspect. Use a long, unique password that is not used anywhere else.
2. Sign the user out of all sessions. In the Microsoft 365 admin center, an administrator can revoke sessions so the attacker is kicked out of any device they are signed in on.
3. Turn on multi-factor authentication (MFA) for the account, and ideally for every account in the business.
4. Check for forwarding. Attackers often set email to forward silently to an outside address. Remove any forwarding you did not set up.
5. Review inbox rules. Look for rules that delete, move to an obscure folder or mark as read emails containing words like invoice, payment, bank or wire. Delete anything suspicious.

The first day: limit the damage

1. Warn your contacts. Tell clients, suppliers and your bookkeeper that your account was compromised and that any change to banking details must be confirmed by phone. This is the single most important step to prevent invoice fraud.
2. Check recent payments. Look for any payment requests or bank detail changes sent in the last few weeks and confirm them by phone using a number you already have.
3. Scan the device the user was working on for malware, and update it.
4. Check other accounts that used the same password, and change them.
5. Review sign-in logs in Microsoft 365 to see where and when the attacker signed in, and whether other users were targeted.
6. Preserve evidence. Do not delete the suspicious emails or rules until they have been reviewed. They help show what happened.

Do you need to report it?

If personal information about clients or staff may have been exposed, Canadian privacy law can require you to assess the breach and, in some cases, report it and notify the people affected. The Office of the Privacy Commissioner of Canada explains the requirements for businesses. If money was lost, contact your bank immediately and report the fraud to the police. The Canadian Centre for Cyber Security also provides guidance and reporting for cyber incidents.

How accounts get compromised in the first place

Most email takeovers start with a convincing fake login page sent by email, a password that was reused on another site that was breached, or an account without multi-factor authentication. We cover how these scams work in our article on spear phishing and invoice fraud.

How to stop it happening again

• Turn on MFA for every user, and block older sign-in methods that skip it.
• Use email security filtering to catch phishing links and fake login pages before they reach the inbox.
• Apply the core Microsoft 365 security settings every small business should have.
• Alert on new forwarding rules and unusual sign-ins.
• Train staff to spot fake login pages and to confirm payment changes by phone.
• Back up Microsoft 365 so mail and files can be restored. See our guide to Microsoft 365 backup.

Frequently asked questions

Is changing the password enough?

No. Attackers often create inbox rules or forwarding that keep working after a password change, and existing sessions may stay signed in. You also need to revoke sessions, remove unknown rules and forwarding, and turn on multi-factor authentication.

Can a hacked email account be used to steal money?

Yes. A common scam is to watch an account quietly and then send a fake invoice or change of banking details to a client or supplier at the right moment. Always confirm payment changes by phone.

Will multi-factor authentication stop this?

It stops most attacks that rely on a stolen password, which is why it is the most important single step. It should be combined with email filtering and staff awareness, because some phishing pages try to capture MFA codes too.

Can you help if we are not a managed IT client?

Yes. We help businesses across Surrey and the Lower Mainland respond to email compromises whether or not they have an ongoing plan with us.

About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.