Treat a Compromised Account as a Business Incident
When an employee clicks a link, enters a work password, or notices messages leaving an account that they did not send, it can be tempting to treat the problem as one person’s password issue. A compromised mailbox can also give someone access to vendor conversations, invoices, customer information, and the people inside the business.
Treat a suspected email-account compromise as a business incident. Bring in your IT team or security provider immediately, cut off the attacker’s access, and find out what the account could reach. That commonly starts with resetting the credential, ending active sessions, and reviewing the account for forwarding rules, unfamiliar sign-ins, mailbox changes, and messages sent in the employee’s name.
A password change alone may not address the rest of the account. The goal is to help the employee regain control while making sure an intruder cannot keep using an old session, a recovery method, or a hidden forwarding rule.
Start With a Trusted Response Channel
Use a trusted way to reach the person who manages your systems. If the company mailbox may be compromised, call or use another approved channel rather than replying inside the affected account.
Your IT provider can help preserve the right logs, confirm whether the attacker is still active, and determine whether the issue reaches beyond one inbox. If the employee used the same password elsewhere, have the team identify those business accounts too.
Document the first facts as the response begins. Note when the issue was discovered, what messages or logins looked suspicious, which accounts were affected, and what actions were taken.
Review the Account and Its Conversations
A compromised mailbox may be used to impersonate a real employee in a conversation that already has trust. Review recent sent mail, deleted items, forwarding settings, and high-value conversations.
If a customer, vendor, or coworker may receive a fraudulent message, give them a simple warning through a verified contact method. Avoid a vague company-wide alert before you know what actually happened.
For example, an Oklahoma contractor may learn that a project manager’s email account sent changed payment instructions to a subcontractor. The office manager can call the IT provider from a phone while the provider secures the account, checks for forwarding rules and unfamiliar sign-ins, and reviews the recent conversation. The contractor can then call the subcontractor using a known number to say that no bank change is valid until it is independently confirmed.
The point is not to guess how far the incident went. It is to contain the account, check the relevant activity, and warn the people who could act on a fraudulent message.
Avoid Two Common Mistakes
One common mistake is changing the password and assuming the problem is over. That can miss an active session, an added recovery method, or a forwarding rule that keeps sending mail outside the business.
Another is warning a vendor by replying to the same email chain from the compromised account. Use a known phone number or another independently verified contact method instead.
Keep Your Response Contacts Ready
Bring in the right decision-makers as the facts become clearer. If your cyber policy has an incident-reporting contact or response process, call early. Many policies direct the insured to particular response resources, and knowing that process before you hire help or make commitments can matter.
When a work email account may be compromised, respond as though it can affect the business, not just one inbox. Contain access, have the right technical team check the account’s activity, and verify sensitive communication outside the questionable email thread.