Has your email account been hacked? Suspicious logins, emails you didn’t send, contacts receiving spam? Follow this step-by-step emergency protocol to regain control and secure your mailbox.
Telltale signs of a hacked email account
Immediate indicators: being unable to log in despite the correct password, emails in “Sent” that you didn’t write, complaints from contacts receiving spam from your address, or mailbox settings changed without your knowledge.
Check the sign-in activity in your security settings: Gmail (Manage your Google Account → Security → Recent security activity), Outlook (account.microsoft.com → Security → Sign-in activity). Foreign IP addresses or unusual times confirm the hack.
Check for forwarding: has someone set up automatic forwarding of your emails to another address? This technique lets hackers keep monitoring your communications even after you change your password.
Modified automatic signatures containing suspicious links or ads often indicate a compromise. Also check your out-of-office auto-replies.
Immediate emergency actions (first hour)
Change your password immediately from a device that has not been compromised (a smartphone on mobile data, another computer). Use a unique, complex password you have never used anywhere else.
Sign out all devices connected to your account: Gmail (Manage your Google Account → Security → Your devices → “Manage all devices” → Sign out), Outlook (account.microsoft.com → Security → “Sign out everywhere”).
Revoke suspicious app permissions: third-party apps with access to your mailbox, unknown sync services, or permissions recently granted to dubious services.
Enable two-factor authentication right away if you haven’t already. Prefer an app (Google Authenticator, Authy) over SMS, which is more vulnerable to attacks.
Advanced email account security
Review your mail rules: automatic filters created by the hacker to redirect, delete or flag certain emails. Delete any rule you didn’t create.
Check the recovery addresses and phone numbers linked to the account: hackers often change this information to keep access even after you intervene.
Check aliases and linked accounts: additional email addresses configured, connected social accounts, cloud storage services synced with your mailbox.
Change your security question if your provider still uses one. Choose a question and answer only you know, unrelated to the information you share publicly on social networks.
Assessing the extent of the damage
Review the full history of emails sent, received and deleted during the compromise period. Look for sensitive communications (banking, professional) that the hacker may have read.
Check your other accounts that use this email address: banks, social networks, online shopping, cloud. Hackers often use the compromised email to reset other passwords.
Look at any suspicious attachments downloaded that could have infected other devices. Scan all your devices with an up-to-date antivirus.
Check your digital identity: search for your name or email on Have I Been Pwned to identify other accounts potentially compromised in data breaches.
Communicating with your contacts
Warn your personal and professional contacts immediately about the hack. Write a clear message explaining the situation and asking them to ignore any suspicious email they receive from you.
Sample message: “My email account was hacked. Don’t open any links or attachments in my recent emails. I have secured my account, but please stay alert for a few days.”
Inform your employer if your work email is affected. The IT department needs to check the infrastructure and warn other employees about the risk of it spreading.
Official reporting: file a complaint if sensitive data has been compromised. In France, contact the CNIL (cnil.fr) for personal data breaches and signal-spam.fr for fraudulent emails sent from your account.
Post-incident monitoring and prevention
Monitor your mailbox closely for 2-3 weeks: suspicious logins, settings changes, strange emails. Hackers sometimes try to come back several times.
Change the passwords of all your other important accounts as a precaution. Use a password manager to generate and store unique credentials.
Update all your devices and software. The initial compromise often comes from an unpatched security flaw or malware on your computer.
Regularly back up your important emails locally. If your account is compromised again, you will still have access to your essential communications even if the account is inaccessible.
Choosing a more secure email provider
Consider ProtonMail or Tutanota for your sensitive communications: end-to-end encryption, servers in Europe and a strong commitment to privacy.
Free providers (Gmail, Outlook) offer decent security but analyse your emails for advertising purposes. For business use, choose paid solutions with technical support.
Advanced security features: automatic encryption, self-destructing messages, tracking blocking and stronger phishing protection.
Leave a Reply