Summary: This guide outlines the immediate steps to take if your email is hacked, how to clean up compromised settings (forwarding rules, filters), and actions to prevent future breaches.
An email breach is a severe threat that can compromise almost all of your online accounts. In this article, we explain how to respond quickly to minimize damage and secure your digital identity.
Signs of an Email Breach
Obvious Signs
- You are locked out of your account, and your password no longer works.
- There are emails in your "Sent" folder that you did not write.
- Your contacts report receiving spam or phishing links from your address.
Hidden Signs
- Incoming emails are mysteriously missing or automatically deleted.
- Email forwarding is enabled to an unfamiliar, external address.
- New rules or filters have been created, or recovery information has changed.
Immediate Action Plan
1. Try to Recover Access
If you can still log in, change your password immediately, terminate all active sessions, and check your recovery options. If you are locked out, use the official password recovery form or contact your email provider's support team directly.
2. Secure Linked Accounts
Attackers often use compromised emails to trigger password resets on other platforms. Check all critical accounts (banking, social media, government services, work accounts) and change their passwords, especially if they shared the same password as your email.
3. Notify Your Contacts
Warn your friends, family, and colleagues that your email was compromised. Advise them not to click any links or download attachments from emails sent by you recently.
Recovery and Clean-Up Checklist
Once you regain access, carefully audit your email settings:
- Forwarding rules: Disable any unauthorized email forwarding configurations.
- Filters & folders: Delete rules that automatically archive, delete, or move incoming messages.
- Signature & auto-replies: Ensure no malicious links have been added to your signature or automatic replies.
Strengthen Security
- Create a strong password: At least 15 characters, utilizing a password manager for generation.
- Enable 2-Factor Authentication (2FA): Prioritize authenticator apps over SMS codes.
- Set up a recovery email: Link a secure alternative email address from a different provider.