I think our email was hacked. What to do first, in order, and what never to touch
A forwarding rule you did not make, contacts getting spam from you, a vendor saying your bank details changed, an invoice paid to a different account: each is a reason to act in the next hour, in the right order. This page gives the order, taken from Microsoft, Google, the FBI and CISA; the five things that destroy evidence or lock you out; the money step; who may have to be told; and what Appluex does, at published prices. It is general guidance and not legal advice.
Stop the attacker's access first. Keep the evidence. Do not touch the money by email
Microsoft lists the signs of a compromised Microsoft 365 mailbox: mail missing or deleted; inbox rules that forward to unknown addresses or move messages into Notes, Junk Email or RSS Subscriptions folders; odd messages in Sent Items or Deleted Items, such as "I'm stuck in London, send money"; changes to the person's entry in the company address list; frequent password changes or lockouts; a newly added external forwarding address; an odd signature; or a mailbox blocked from sending. Add the two that bring most owners to this page: a vendor or client says your payment instructions changed, or money went to an account that is not the usual one.
The first rule is the order. An attacker with access to a mailbox usually leaves ways back in: a forwarding rule, a second sign-in method, an app you were asked to approve, a saved sign-in session. Changing the password alone does not close all of them. Microsoft says plainly that app passwords are not revoked when the password is reset, and Google says suspending an account also resets its sign-in cookies and OAuth tokens, which is why a reset on its own is not enough. CISA adds that a password reset is only temporary if the attacker can still steal tokens.
The second rule is evidence. Write down and photograph what you see before you change it: the rule, the forwarding address, the sign-in list with its places and times, the odd message. Do not delete the rule or the mail first. What the attacker did, and when, decides who has to be told, what your insurer and your bank will ask for, and whether a fraudulent payment can be recalled. Microsoft's own steps tell the administrator to review the audit logs from the start of the suspicious activity, so those logs must not be disturbed.
The third rule is about money. Never pay, change a bank detail or send a gift card on the strength of an email, even one that looks like it comes from someone you know, and even if the account turns out to be the one that was hacked. The FBI's Internet Crime Complaint Center (IC3) advises using a second channel to verify any request to change account information. A phone call to a number you already had, not one printed in the email, is that second channel.
If you have an IT provider or an administrator for your Microsoft 365 or Google Workspace account, the steps below are theirs to run, and the order still matters. If nobody administers your account, you can do the safe first steps on this page yourself and then call. Where a step needs an administrator, it says so.
Record first, then remove. Cut off access in the right order. And do not move money on an email.
Preventing the next one (a second sign-in step, blocking others from sending as you, a call-back rule for bank changes) is covered on the email security page
What to do first, in order, and what never to do
Do these in this order. The steps that need an administrator are marked. If you cannot tell whether you can do a step, stop and call: a step done out of order can lock you out or erase what you need.
Record what you see, then stop touching it
Photograph the forwarding rule, the odd sign-in list, the strange message, the vendor's email about new bank details. Write the date and time you noticed. Do not delete any rule or message yet, and do not reply to the attacker or to the suspicious email. A reply tells them you are watching.
Change the password from a device you trust
Use a computer or phone you are confident is clean, on a network you trust, and choose a new password nobody has seen. Do not email or text it to anyone: Microsoft warns that the attacker could have access to the mailbox. Do not reuse any of your last five. If the account is an administrator account, tell the other administrators first. An administrator may prefer to disable the account until the work is done, which Microsoft says is preferred, and which does not lose the mail.
Sign out everywhere and revoke the access that stays
A new password does not end a sign-in that is already open. An administrator revokes the user's sessions (Microsoft) or suspends the account, which resets sign-in cookies and tokens (Google). App passwords must be deleted and created again, because a password change does not remove them. Revoke the account's tokens and OAuth access too.
Check for a second sign-in method you did not add
Attackers add their own phone or app as a sign-in method so they can come back. Open the account's security info and remove any method the owner did not add (Microsoft Step 3). Then turn on a second sign-in step for everyone. CISA says to aim for phishing-resistant methods such as a security key, treats text or email codes as the weakest, and says any MFA is better than none.
Review forwarding, inbox rules, apps and who else has access
Look at the mailbox's forwarding address and every inbox rule, including hidden ones (Microsoft Step 6), the filters and forwarding in Gmail (Google), the applications that were given consent (Microsoft Step 4) and the roles the person holds (Step 5). As our own check, also see who else has been given access to the mailbox. Record each one as in step 1, then remove it.
What never to do
Do not delete the suspicious mail or rules before they are recorded. Do not wipe or reinstall the computer, because it holds the evidence of how they got in. Do not reply to the attacker. Do not reset every employee's password at once without a plan: you lock out staff while the attacker may still hold a session. Never pay, wire or change a bank detail because of an email. Never read a code from a text or an app out loud to anyone who calls.
The money step: call the bank and the other party now
If money has moved, call your bank and ask for a recall or reversal, and for a hold harmless letter or letter of indemnity, using the bank's own phone number and not one from an email. IC3 says to contact the originating financial institution "as soon as fraud is recognized" and to file a detailed complaint at ic3.gov including the banking information. IC3's page gives no number of hours or days, so do not wait to find one. Then call the vendor or client on a number you already had and tell them their email may be compromised too.
Four parts to an email incident, and which are yours
Everything here is labour on the accounts you already pay for. We do not sell hardware, and we do not promise an outcome that depends on a bank or a criminal.
1. Contain: cut off the attacker's access
In the order Microsoft and Google publish: disable or suspend the account, reset the password to a new one not sent by email, revoke sessions and tokens, delete the app passwords, and review the second-sign-in methods and the apps that were given consent. It is done once, in order, from a device you trust, and each change is written down.
2. Find out what they did
Read the sign-in and audit logs from the start of the suspicious activity: where and when the sign-ins came from, what rules and forwarding were added, which mail was sent. Microsoft's own guidance says to review the logs and the sent messages for the period. You get a written timeline, which is what a bank, an insurer or a lawyer asks for first. This is incident response at $295 an hour.
3. The money and the notices are yours, with our paperwork
The call to the bank, the complaint to the FBI at ic3.gov and any legal notice are made by you or by your lawyer. We prepare the facts they ask for: dates, addresses, messages, the account the money went to. We cannot recall a payment, and we cannot promise one comes back.
4. Close the door
After containment, the causes are fixed so the same thing does not repeat: the security baseline (a second sign-in step everywhere), full protection against others sending as your company, a written call-back rule for any bank change, and a password manager so passwords are not reused. Each is a published price in the rate card below.
The rate card, including what turns up after the work starts
An incident is billed by the hour with a written cap you approve first, because nobody can know its size in advance. The prevention jobs are published fixed prices. Nothing extra is done without your written yes. We do not sell hardware, security keys or licences: you buy them from the vendor, and we configure and test them (labour only).
| Incident response, no retainer2-hour minimum. The size of an incident cannot be known in advance, so the work is hourly with a written cap you approve first. Nothing is done past the cap without your written yes. | $295 an hour |
|---|---|
| Incident retainer (prepaid hours)Up to 25 users and 6 prepaid hours. Hours beyond those are $165 an hour in business hours and $195 an hour after hours. A retainer has to be in place before an incident to be used in it. | $2,400 a year |
| Work that must be done on siteVisits in Cape Coral, Fort Myers, Estero, Bonita Springs and Naples only. In Cape Coral and Fort Myers the minimum is 1 hour and there is no travel charge. Visits in Estero, Bonita Springs and Naples have a 2-hour minimum, which covers the drive. Time past the minimum is billed in 30-minute steps. Everywhere else the work is remote, which is how most of it is done. | $150 an hour |
| Security baseline, up to 10 usersEach user beyond 10 is $29, up to 25 users. A second sign-in step on every mailbox and admin account, with old password-only sign-in switched off, written down. | $995 |
|---|---|
| Second sign-in step only (MFA), up to 10 users$15 per user beyond 10. A hardware security key is $25 per user in labour; you buy the key from the vendor. | $395 |
| Stopping others from sending as your company (DMARC enforcement), per domain3 months of monitoring included, then $35 per domain a month. Extra domain on the same account: $395. | $695 |
| Payment Fraud Shield, setup for up to 10 usersEach user beyond 10 is $29. Monitoring is $19 per user a month, minimum $95 a month. It includes a written call-back rule for any change of bank details, with staff training. | $1,295 |
| Password manager, base setup$39 per user. Single sign-on is $195. The password manager subscription itself is bought from its vendor. | $395 |
| Anything else the incident turns upQuoted in writing before it starts, at the published hourly rates. | Fixed price, named on the quote |
Prices are published figures. Time on an incident is billed at the incident rate for the hours worked, with the stated minimum. No outcome is guaranteed, including the return of any money.
Why Appluex for an email incident
A published order, not a guess
The containment order follows the steps Microsoft and Google publish, and each action is written down as it is done. That record is what your bank, your insurer and a lawyer ask for.
A published rate, with a cap you approve
Incident response is $295 an hour with a 2-hour minimum, or $165 an hour in business hours and $195 an hour after hours for clients on an incident retainer. The work is capped in writing before it goes further.
We say what is not ours to promise
We cannot recall a wire, decide whether Florida's notice law applies to you, or promise that money returns. Those belong to your bank, your lawyer and the authorities. We say that on day one and prepare everything they will ask for.
Support in Spanish at the same price
The same steps, the same people and the same prices in Spanish and in English, so a manager can read the instructions and the staff can follow them.
Documents you can hand to your bank, insurer or lawyer
The job ends with written evidence, not a verbal all-clear.
Containment record
- Each action in order: account disabled or suspended, password changed, sessions and tokens revoked, app passwords deleted
- Second-sign-in methods found and removed
- Forwarding addresses, inbox rules and app consents found and removed, each as recorded before removal
Findings
- Timeline from the logs: sign-in places and times, rules added, mail sent
- Which mailboxes and which kinds of information were reachable
- A list of the people and companies who received mail from the compromised account
For the people who decide
- The facts your bank asks for when you request a recall
- The facts your lawyer needs to decide on Florida notice
- What was changed to close the door, with the published price of each
Email hacked. Questions owners ask
What do we do first if we think our email was hacked?
Photograph and write down what you see, then change the password from a computer or phone you trust, without sending the new password by email. Next, an administrator signs the account out everywhere, revokes its sessions and app passwords, and checks for a second sign-in method, forwarding rules, inbox rules and app consents nobody on your team added. Do not delete anything first, and do not reply to the attacker. The steps above follow what Microsoft and Google publish.
Should we pay, or send the gift cards or the wire they ask for?
No. Never pay, wire or change a bank detail because an email says so, even if it appears to come from someone you know, because the account that sent it may be the one that was hacked. The FBI's Internet Crime Complaint Center advises using a second channel to verify any change of account information. Call the person on a number you already had, not the one in the message, and call your bank if any money has already moved.
We paid an invoice to a new bank account. Can the money come back?
We cannot promise it, and nobody can. What you can do is act at once: call your bank on its own number and ask for a recall or reversal and a hold harmless letter or letter of indemnity, then file a complaint at ic3.gov. IC3 says to contact the originating financial institution as soon as fraud is recognized. Its page gives no figure for how long you have, so treat every hour as mattering. We prepare the dates, accounts and messages the bank and IC3 ask for.
Do we have to tell our clients?
It depends on the facts, and a lawyer decides. Florida has a data breach law, section 501.171 of the Florida Statutes. Its text sets a deadline for notifying affected individuals of no later than 30 days after a breach is determined or there is reason to believe one occurred, subject to its own exceptions. It also has a separate notice to the state for breaches affecting 500 or more people in Florida. Whether your incident is a breach under that law depends on what information was reachable, which is why we hand your lawyer a written timeline.
We hold health information. Does anything else apply?
Possibly. HIPAA has its own breach notification rules, which can apply to practices and their business associates that hold patient health information. We say only that they exist; whether they apply to you, and what they require, is a question for a healthcare compliance lawyer, and the sooner you ask, the better.
Should we delete the forwarding rule and the weird emails right away?
Not before they are recorded. Photograph the rule, the forwarding address and the messages, and note the dates first. Those records show what the attacker did and for how long, and the sign-in and audit logs that Microsoft tells administrators to review are part of the same evidence. Then remove the rule and forwarding, because leaving them keeps the attacker reading your mail.
Should we wipe the computer or reset everyone's password?
Do not wipe the computer yet: it holds the evidence of how they got in, and the attacker's access is usually through the account, not the machine. Do not reset every password at once without a plan either. Staff get locked out while a session the attacker holds may stay open. Reset the compromised account first and revoke its sessions, then widen the reset in a planned order if the logs show other accounts were reached.
How do we find out what the attacker actually did?
The sign-in logs answer it. Microsoft's Entra sign-in logs and Google's user log events list the place, time and result of each sign-in, and Google keeps up to six months of web sign-ins in its log. A sign-in from somewhere you have no one, at an hour nobody works, is the sign. We read the logs for the period and write down what they show.
Is an incident covered by a plan, and what does it cost?
An email incident is billed at $295 an hour with a 2-hour minimum, or $165 an hour in business hours and $195 an hour after hours for clients on an incident retainer. The work has a written cap you approve first. Closing the door afterwards has published prices: the security baseline from $995, DMARC enforcement $695 per domain, Payment Fraud Shield setup from $1,295 and a password manager setup from $395. We promise no outcome and no response time.
Do you come to the office, and where can you help?
Most of the work is remote, from anywhere. In-person visits are in Cape Coral, Fort Myers, Estero, Bonita Springs and Naples only, at $150 an hour. In Cape Coral and Fort Myers the minimum is 1 hour and there is no travel charge. Visits in Estero, Bonita Springs and Naples have a 2-hour minimum, which covers the drive. Time past the minimum is billed in 30-minute steps. A nearby address outside those five cities gets remote support. We do not sell computers, phones or security keys: if a device needs replacing, you buy it and we set it up.
Other ways we can help
Something isn't working?
Email stopped, a computer will not start, the internet is down at the office: call and tell us what is happening, in English or Spanish. You will know the price before any work starts.
In person in Cape Coral, Fort Myers, Estero, Bonita Springs and Naples. Remote support anywhere.