--- title: 'Microsoft 365 Account Hacked? What to Do Next' url: 'https://triplepoint.org.uk/guides/microsoft-365-account-hacked' markdown: 'https://triplepoint.org.uk/guides/microsoft-365-account-hacked.md' date: '2026-10-28' description: 'Think your Microsoft 365 account has been hacked? The warning signs, the steps to take right now, and why MFA alone no longer stops attackers.' --- # Microsoft 365 Account Hacked? What to Do Next ![](https://triplepoint.org.uk/user/pages/guides/microsoft-365-account-hacked/microsoft-365-account-hacked.jpg) **If you think a Microsoft 365 account has been hacked, change its password from a different device you trust, sign the account out of every session, remove any sign-in methods, forwarding rules or apps you don't recognise, then warn your contacts by phone.** If the account has admin rights, or money may have been sent, get specialist help straight away: those two make the damage spread fastest. ## The warning signs Microsoft's own [guidance on compromised accounts](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account) lists the tell-tale signs. In plain English, look for: - **People getting emails from you that you didn't send,** often asking for money, a payment or a "shared document" link. - **Messages in your Sent or Deleted Items that you didn't write.** - **Inbox rules you didn't create,** especially ones that forward mail to an outside address, or quietly move messages into folders you never look at, such as RSS Subscriptions or Junk. - **Emails going missing,** particularly replies from customers or suppliers. - **Sign-in prompts you didn't ask for,** password reset messages, or being locked out unexpectedly. - **A sign-in method you don't recognise,** such as a new phone added to your account. - **Being blocked from sending email,** which happens when Microsoft spots the account sending spam. One sign on its own can be innocent. Two or more, or anything involving payments, means acting now. ## What to do right now Work through these in order. If you have an IT provider, call them first and go through the list together. 1. **Change the password, from a different device you trust.** If the attacker has your laptop or browser, a new password typed there could be captured too. Don't send the new password to anyone by email: the attacker may still be reading it. 2. **Sign the account out of every session.** Changing the password doesn't always end a session the attacker already has. An administrator can sign the account out everywhere from the Microsoft 365 admin centre. 3. **Remove sign-in methods you don't recognise.** Attackers often register their own phone or authenticator app so they can get back in later. 4. **Check for forwarding and inbox rules.** Delete any rule that forwards, redirects or hides messages. Your administrator can also check for hidden rules and mailbox-level forwarding that don't show up in Outlook. 5. **Check which apps have access.** Some attacks trick people into approving a malicious app rather than stealing a password. Remove any you didn't knowingly approve. 6. **Check for admin rights.** If the account is an administrator, check whether other accounts were created or changed. 7. **Warn people by phone.** Anyone who may have had an email from the account should hear from you directly. If any email asked for a payment or new bank details, read our guide to [invoice fraud](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise) and call your bank now if money has gone. 8. **Keep the evidence.** Don't delete emails or reset everything to factory settings yet. Sign-in and audit logs show where the attacker came from and what they did, and they're only kept for a limited time. If you're not sure how far it went, our [business email compromise response](https://triplepoint.org.uk/security/incident-response/business-email-compromise) investigates exactly this: what was read, sent and changed, and how the attacker got in. ## On Google Workspace instead? The signs and the steps are the same. The settings are in different places: - **Password and sessions:** an administrator can reset the password in the Google Admin console, open the user's security settings and reset their sign-in cookies, which signs them out of every session. - **Sign-in methods:** check the 2-Step Verification phones, recovery phone and recovery email in the user's Google Account security settings. - **Forwarding and filters:** in Gmail, open Settings, See all settings, then check Forwarding and POP/IMAP, Filters and Blocked Addresses, and anyone granted access to the account under Accounts. - **Connected apps:** remove any you don't recognise from the third-party connections in the Google Account security settings. - **Evidence:** the audit and investigation logs in the Admin console show sign-ins and Gmail activity, so keep them before changing too much. Most of the advice below applies to Google Workspace too. The exception is our identity threat detection, which covers Microsoft 365. ## Why MFA alone didn't stop it In Sophos's [State of Ransomware 2026](https://www.sophos.com/en-us/press/press-releases/2026/07/79-percent-ransomware-attacks-originate-from-compromised-identities) survey of 2,158 organisations that had been hit, **79% of attacks started with a compromised identity**, and where stolen credentials were the way in, **multi-factor authentication was in place in some form in 97% of incidents**. So MFA is essential, but on its own it isn't enough. The two most common ways round it: - **Fake sign-in pages that work in real time.** You enter your password and approve the prompt as normal, but the page is passing everything to Microsoft (or Google) on your behalf, and keeps the signed-in session for itself. The attacker never needs your phone again. - **Prompt bombing.** The attacker already has the password and sends sign-in request after request, often late at night, until someone taps "approve" just to make it stop. There are also gaps: an old shared mailbox, an admin account or a legacy app that was never covered. ## How to stop it happening again - **Switch to phishing-resistant sign-in.** Passkeys and hardware security keys only work on the genuine Microsoft or Google site, so a fake page can't capture them. Start with administrators, then finance staff. - **Put MFA on every account,** including shared mailboxes and any account used by an app or a printer. - **Block automatic forwarding to outside addresses,** so a hidden rule can't quietly copy your mail elsewhere. - **Use separate admin accounts** for administration, never for everyday email. - **Have someone watching.** [Identity threat detection](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) spots suspicious sign-ins, risky settings and staff passwords leaked online, and can sign a compromised account out of every session, and [email security](https://triplepoint.org.uk/security/people-and-email/email-security) stops much of the phishing that starts it all. With [24/7 MDR](https://triplepoint.org.uk/security/detect-and-respond/mdr), analysts act on those alerts at any hour. If you'd like a second pair of eyes on your Microsoft 365 or Google Workspace setup, [talk to us](https://triplepoint.org.uk/contact?about=Microsoft%20365%20account). ## Questions Will changing the password lock the attacker out?+Not on its own. An attacker can stay signed in on a session they already have, and app passwords aren't cancelled when you change the main password. Sign the account out of every session as well, and remove any sign-in methods, forwarding rules and apps you don't recognise. We had MFA switched on. How did they get in?+Most likely through a fake sign-in page that passes your details to Microsoft in real time and captures the signed-in session after you approve the prompt. The same trick works against Google accounts. Repeated prompts until someone taps approve is another common route. Phishing-resistant sign-in, such as passkeys, closes both gaps. Do we have to report it?+Possibly. A mailbox usually holds personal data, so a compromise can be a reportable breach: UK GDPR requires reporting to the ICO within 72 hours of finding out, unless it's unlikely to put anyone at risk. If money has been sent, call your bank first, then report it to Report Fraud. Can we see what the attacker did?+Usually, yes. Microsoft 365 keeps sign-in and audit logs showing where the account was used from and what changed, but only for a limited time. Don't delete anything until someone has checked them. Do the same steps work for a hacked Google Workspace account?+Yes, the order is the same: new password from a trusted device, sign out every session, then check sign-in methods, Gmail forwarding and filters, and connected apps. The settings are in different places, and the section on Google Workspace above shows where. Where to go next- [Business email compromise response](https://triplepoint.org.uk/security/incident-response/business-email-compromise) - [Identity threat detection for Microsoft 365](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) - [Invoice fraud: how business email compromise works and how to stop it](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [MDR vs EDR vs XDR: What Does a Small Business Need?](https://triplepoint.org.uk/guides/mdr-vs-edr-vs-xdr.md) - Next: [How Much Does a Penetration Test Cost in the UK?](https://triplepoint.org.uk/guides/penetration-test-cost-uk.md)