Microsoft 365 account hacked? What to do next

If you think a Microsoft 365 account has been hacked, change its password from a different device you trust, sign the account out of every session, remove any sign-in methods, forwarding rules or apps you don't recognise, then warn your contacts by phone. If the account has admin rights, or money may have been sent, get specialist help straight away: those two make the damage spread fastest.

The warning signs

Microsoft's own guidance on compromised accounts lists the tell-tale signs. In plain English, look for:

• People getting emails from you that you didn't send, often asking for money, a payment or a "shared document" link.
• Messages in your Sent or Deleted Items that you didn't write.
• Inbox rules you didn't create, especially ones that forward mail to an outside address, or quietly move messages into folders you never look at, such as RSS Subscriptions or Junk.
• Emails going missing, particularly replies from customers or suppliers.
• Sign-in prompts you didn't ask for, password reset messages, or being locked out unexpectedly.
• A sign-in method you don't recognise, such as a new phone added to your account.
• Being blocked from sending email, which happens when Microsoft spots the account sending spam.

One sign on its own can be innocent. Two or more, or anything involving payments, means acting now.

What to do right now

Work through these in order. If you have an IT provider, call them first and go through the list together.

1. Change the password, from a different device you trust. If the attacker has your laptop or browser, a new password typed there could be captured too. Don't send the new password to anyone by email: the attacker may still be reading it.
2. Sign the account out of every session. Changing the password doesn't always end a session the attacker already has. An administrator can sign the account out everywhere from the Microsoft 365 admin centre.
3. Remove sign-in methods you don't recognise. Attackers often register their own phone or authenticator app so they can get back in later.
4. Check for forwarding and inbox rules. Delete any rule that forwards, redirects or hides messages. Your administrator can also check for hidden rules and mailbox-level forwarding that don't show up in Outlook.
5. Check which apps have access. Some attacks trick people into approving a malicious app rather than stealing a password. Remove any you didn't knowingly approve.
6. Check for admin rights. If the account is an administrator, check whether other accounts were created or changed.
7. Warn people by phone. Anyone who may have had an email from the account should hear from you directly. If any email asked for a payment or new bank details, read our guide to invoice fraud and call your bank now if money has gone.
8. Keep the evidence. Don't delete emails or reset everything to factory settings yet. Sign-in and audit logs show where the attacker came from and what they did, and they're only kept for a limited time.

If you're not sure how far it went, our business email compromise response investigates exactly this: what was read, sent and changed, and how the attacker got in.

On Google Workspace instead?

The signs and the steps are the same. The settings are in different places:

• Password and sessions: an administrator can reset the password in the Google Admin console, open the user's security settings and reset their sign-in cookies, which signs them out of every session.
• Sign-in methods: check the 2-Step Verification phones, recovery phone and recovery email in the user's Google Account security settings.
• Forwarding and filters: in Gmail, open Settings, See all settings, then check Forwarding and POP/IMAP, Filters and Blocked Addresses, and anyone granted access to the account under Accounts.
• Connected apps: remove any you don't recognise from the third-party connections in the Google Account security settings.
• Evidence: the audit and investigation logs in the Admin console show sign-ins and Gmail activity, so keep them before changing too much.

Most of the advice below applies to Google Workspace too. The exception is our identity threat detection, which covers Microsoft 365.

Why MFA alone didn't stop it

In Sophos's State of Ransomware 2026 survey of 2,158 organisations that had been hit, 79% of attacks started with a compromised identity, and where stolen credentials were the way in, multi-factor authentication was in place in some form in 97% of incidents.

So MFA is essential, but on its own it isn't enough. The two most common ways round it:

• Fake sign-in pages that work in real time. You enter your password and approve the prompt as normal, but the page is passing everything to Microsoft (or Google) on your behalf, and keeps the signed-in session for itself. The attacker never needs your phone again.
• Prompt bombing. The attacker already has the password and sends sign-in request after request, often late at night, until someone taps "approve" just to make it stop.

There are also gaps: an old shared mailbox, an admin account or a legacy app that was never covered.

How to stop it happening again

• Switch to phishing-resistant sign-in. Passkeys and hardware security keys only work on the genuine Microsoft or Google site, so a fake page can't capture them. Start with administrators, then finance staff.
• Put MFA on every account, including shared mailboxes and any account used by an app or a printer.
• Block automatic forwarding to outside addresses, so a hidden rule can't quietly copy your mail elsewhere.
• Use separate admin accounts for administration, never for everyday email.
• Have someone watching. Identity threat detection spots suspicious sign-ins, risky settings and staff passwords leaked online, and can sign a compromised account out of every session, and email security stops much of the phishing that starts it all. With 24/7 MDR, analysts act on those alerts at any hour.

If you'd like a second pair of eyes on your Microsoft 365 or Google Workspace setup, talk to us.

< Back to Guides