What to Do If Your Business Email Gets Hacked
Tips · Security & IT
Business email gets hacked more often than most owners want to admit. Someone gets into your inbox, sends invoices to your customers with a new “wire to this account” line, or quietly reads every message for weeks. The longer it sits, the worse the cleanup.
Here’s a calm, practical checklist. Do the first items immediately. Then harden things so it doesn’t happen again.
1. Lock the account now
Change the password from a device you trust — not the one you think might be infected. If you use the same password anywhere else (banking, Shopify, payroll), change those too. Turn on two-factor authentication (a code from an app or hardware key, not just SMS if you can avoid it).
Sign out of all sessions if your email provider offers that option. That kicks the attacker off even if they still have the old password.
2. Check what they touched
Look for:
- Inbox rules that auto-forward or auto-delete mail (attackers hide their tracks this way)
- Sent items you didn’t send — especially anything with invoices, W-9s, or bank details
- New mailbox delegates or “app passwords” you didn’t create
- Calendar invites or shared drives that suddenly appeared
Screenshot anything suspicious before you delete it. You may need those details for your bank, your customers, or a report.
3. Warn the people who might have been hit
If fake invoices or password-reset links went out from your address, tell those customers and vendors right away. A short, honest note beats silence. Tell them what to ignore, how to verify real invoices from you going forward (for example, always call a known number before wiring money), and that you’re on it.
If payroll, banking, or tax accounts were in that inbox, call those institutions. Speed matters more than perfect wording.
4. Clean the devices and stop the leak
Email takeovers often start with a phished password or malware on a computer. Run a full scan on the machines that use that mailbox. Update the operating system and browser. Remove browser extensions you don’t recognize.
If this is a company domain (you@yourbusiness.com), review who still has accounts. Disable former employees. Stop shared “info@” passwords written on sticky notes.
5. Put guardrails in place
After the fire is out:
- Require strong, unique passwords (a password manager helps)
- Require two-factor authentication for every mailbox
- Turn on alerts for new sign-ins from odd places
- Train your team: nobody changes wire instructions by email alone
- Keep regular backups of important mail and files
These steps are boring. They’re also what keeps a bad afternoon from becoming a bad quarter.
When to call for help
If you’re not sure how deep the breach went, if customers already paid a fake invoice, or if your whole office runs on Microsoft 365 / Google Workspace and you don’t want to guess — get a pro involved.
Managed IT for Xtreme Business Solutions runs through our Local IT Repair brand: same company, focused on computers, networks, security, backups, and day-to-day support. Southern California-based, helping clients nationwide remotely when you need it.
Website and email go together
A polished website doesn’t help much if your inbox is the weak link. We help businesses look professional online and stay productive behind the scenes. If you want a straight checkup on your site, your email setup, or both, start here.
Need hands-on IT help right away? Visit localitrepair.com.