Business Email Hacked? What to Do in the First Hour (Microsoft 365)

Your colleague got a reply to an email they never sent. A vendor is asking about “your new bank details”. Microsoft flagged a sign-in from another country. If your business email has been hacked, the next hour matters more than the next week.

This checklist is for companies on Microsoft 365 / Office 365. Work through it in order.

If money may already have been sent: call your bank now and ask for a recall of the transfer, then come back to this list. Minutes matter.

Step 1: Lock the attacker out

Changing the password alone is not enough — existing sessions and tokens can stay valid.

1. Reset the password of the compromised account (and any account that used the same password).
2. Revoke all sessions — in the Microsoft Entra admin center, open the user and select Revoke sessions. This forces every device, including the attacker’s, to sign in again.
3. Check the MFA methods registered on the account. Delete any phone number, authenticator app or device the user does not recognise. Attackers often add their own.
4. If you are not sure how far it has spread, temporarily block sign-in for the account while you investigate.

Step 2: Find what the attacker left behind

Attackers set things up to keep access and to hide from the user.

• Inbox rules — look for rules that move emails to RSS Feeds, Archive or Deleted Items, or that match words like invoice, payment, wire, bank or a specific vendor name. Delete them.
• Forwarding — check mailbox forwarding (in the Exchange admin center) and any rule that forwards to an external address.
• App consents — in Entra ID, review Enterprise applications for apps the user consented to recently, especially ones with mail-read permissions.
• Delegated access — check whether anyone was given Full Access or Send As on the mailbox.

Step 3: Work out what happened

Before you clean up too much, preserve evidence.

• Sign-in logs (Entra ID): when did suspicious sign-ins start, from which IPs and countries?
• Unified audit log (Microsoft Purview): which emails and files were accessed, which rules were created?
• Message trace: what did the account send, and to whom?

Note the date of the first malicious sign-in. Everything after that point may have been read by the attacker.

Step 4: Check whether other accounts are compromised

The first mailbox is rarely the only one. Attackers send phishing emails from the hacked account to colleagues and customers, because those emails are trusted.

• Search message trace for emails sent from the compromised account during the attack window
• Look for the same suspicious IP addresses in other users’ sign-in logs
• Ask staff whether they clicked anything that came from the compromised account

Step 5: Warn the right people

• Finance and accounts payable — freeze any bank-detail changes until verified by phone on a known number
• Customers and vendors who received emails from the account during the attack window
• Your bank — if any payment was made or requested
• Your cyber insurer — most policies require prompt notice, and some require using their approved responders
• Law enforcement — in the US, file a report with the FBI’s Internet Crime Complaint Center (IC3)
• Legal counsel — if personal, health or financial data may have been exposed, notification laws may apply

Step 6: Close the door

Once the attacker is out, fix how they got in:

• Enforce MFA for every user — phishing-resistant MFA for admins and finance
• Block legacy authentication (POP, IMAP, SMTP AUTH)
• Restrict users from consenting to third-party apps
• Block automatic forwarding to external addresses
• Set DMARC to enforcement so nobody can spoof your domain

A Microsoft 365 security assessment checks all of this and more, and tells you what to fix first.

Signs your email has been compromised

• Sent emails you did not write, or replies to messages you never sent
• Missing emails, or rules you did not create
• Password reset or MFA prompts you did not trigger
• Sign-in alerts from unfamiliar locations
• Contacts saying they received strange emails or links from you

When to call for help

Bring in incident responders if:

• Money was sent or requested
• More than one account is affected
• You cannot tell what the attacker accessed
• Regulated data (health, financial, personal) was in the mailbox
• Your insurer or lawyer needs a documented investigation

HIFENCE handles business email compromise response for Microsoft 365: containment, investigation, a written timeline, and hardening afterwards.

FAQ

My email was hacked — is changing my password enough? No. You also need to revoke sessions, remove any MFA methods or apps the attacker added, and delete malicious inbox and forwarding rules.

How did they get in if we have MFA? Modern phishing kits capture the session cookie after you complete MFA, so the attacker does not need your code again. Phishing-resistant MFA and Conditional Access device requirements stop this.

How do I know what the attacker read? The Microsoft Purview unified audit log and mailbox audit records show mailbox access — if auditing was enabled and the logs are still within retention.

Should I delete the hacked account? No. Deleting it can destroy evidence you will need for the investigation, your insurer and law enforcement. Block sign-in instead.

Business email hacked? Contact HIFENCE for incident response. Contact us.