Act quickly, because a compromised mailbox is usually being used within hours.
IMMEDIATE ACTIONS
- Change that mailbox's password, and every other mailbox on the account. Use new, strong, unique values.
- Update the password on every device and client using it, including phones you rarely check.
- Check for forwarding rules and filters you did not create. Attackers add these so you do not see replies and warnings.
- Check webmail settings for an altered signature or reply-to address.
- Scan every computer and phone that accesses the mailbox.
- Open a ticket telling us what you found.
WHY THE FORWARDING CHECK MATTERS
A rule quietly forwarding your mail elsewhere is how invoice fraud is set up. The attacker watches until an invoice is due, then intervenes. Removing the password without removing the rule leaves them watching.
AFTERWARDS
Your domain may be blacklisted. See the blacklist article. Avoid bulk sending for a few weeks while reputation recovers.
Tell colleagues and key contacts what happened, particularly if payment instructions could have been forged.
