October 9, 2026

By PhishClean Research Team - browser security guidance based on phishing analysis, defensive research, and product work.

Our business email was hacked and emailed our clients. What now?

A client calls to ask about the invoice you sent this morning, and you didn't send one. Someone has your mailbox. This is the order to work in today, written for a small office without a security team, on Microsoft 365 or Google Workspace.

Keep this page open and work down it. The first two sections take about an hour. Don't start writing to clients until the account is locked, or the attacker can read your apology and reply to it.

1. Lock the account (first 30 minutes)

Changing the password alone is not enough. Attackers who got in through a fake login page usually hold a session cookie, which keeps them signed in after the password changes. Microsoft has documented phishing kits that sit between the victim and the real sign-in page and take that cookie, which gets past text-message and app MFA (Microsoft, 2022). So:

If nobody in the office has admin rights, call whoever set up your email (your IT provider or the person who registered the domain). This hour matters more than any other.

2. Remove what the attacker left behind

Attackers set things up so they keep receiving your mail, or so you don't see the replies to their fraud. Microsoft's own checklist for a compromised mailbox lists these places (Microsoft Learn):

• Inbox rules. Look for rules that forward mail to an outside address, or that move messages to Junk, RSS Subscriptions, Notes or Archive. A rule that hides any email containing "invoice", "payment" or "bank" is a classic sign. In Microsoft 365, hidden rules only show up with Get-InboxRule -IncludeHidden.
• Forwarding. Mailbox-level forwarding (Microsoft 365) or the Forwarding tab in Gmail settings.
• Sign-in methods. An extra authenticator app or phone number the attacker added so they can pass MFA next time.
• Connected apps. Third-party apps that were granted access to the mailbox. Remove anything nobody recognises.
• Delegates and signature. Someone else given access to the mailbox, or a signature changed to show different bank details.

3. Find out what was sent, and to whom

Check Sent Items and Deleted Items for the window the attacker had. Then check the server's own record, because attackers delete what they send: Message trace in the Microsoft Defender portal, or Email Log Search in the Google Admin console. Export the list of recipients. That is your contact list for the next step.

Note the sign-in log too (Entra sign-in logs, or the Google Admin audit log): the first sign-in from an unfamiliar country or IP gives you the start of the window.

4. Tell clients, briefly and from a channel you trust

Keep the message short and specific. A long explanation reads like another phishing email. Something like:

Send it from a mailbox that wasn't affected, and phone your largest clients and anyone with a payment due this week. Phone calls are slower, but they are the only channel the attacker can't fake.

5. Money that may already have moved

Business email compromise is where the losses are: the FBI's 2025 Internet Crime Report puts reported US losses to it at just over $3 billion for the year. Most of it moves by wire or bank transfer, and speed is what gets it back.

• If you or a client paid an invoice that came from the hacked account, call the sending bank now and ask for a recall.
• In the US, report it at ic3.gov the same day. The FBI's Recovery Asset Team works from those complaints, and fresh ones have the best odds.
• In the UK, report to Report Fraud. In India, call 1930 or file at cybercrime.gov.in.

6. Check whether you have to report a data breach

If the mailbox held other people's personal information, such as client ID documents, health details, payroll or tax records, you may have a legal duty to notify them and a regulator. In the UK and EU that clock is 72 hours from when you become aware, under GDPR. US states and sector rules (HIPAA for healthcare, for example) have their own deadlines. If you have cyber insurance, call the insurer before you call anyone else: most policies cover the forensic review and the letters, and some require you to use their panel.

7. Stop it happening again

Look at how they got in. In most small-office cases it's one person typing their password into a page that looked like the Microsoft or Google sign-in, after an email about a shared document, a voicemail or an unpaid invoice.

• Turn on MFA for everyone, and prefer passkeys or security keys. These are tied to the real site, so they don't work on a fake page.
• Use a password manager. It fills passwords only on the real domain. When it doesn't offer to fill, that's the warning.
• Block external auto-forwarding at the organisation level, so a new inbox rule can't quietly send mail out.
• Put a warning in the browser itself. A fake login page is caught most reliably at the moment someone is about to type into it. See how to stop staff typing passwords into fake login pages for the options, including ours.

Last updated: 9 October 2026