Best Practices for Responding to a Compromised Email Mailbox

Immediate Actions

1. Change the Password

• Reset the compromised account password immediately.
• Ensure the new password is strong (at least 12 characters, mixed case, numbers, and special characters).
• Avoid using previously used passwords.

2. Review and Remove Unauthorized Access

• Check for unauthorized forwarding rules, auto-replies, or filters that may be forwarding emails to external addresses.
• Remove suspicious app integrations (if any).

Investigate the Impact

3. Check for Sent Spam or Phishing Emails

• Review the "Sent" folder for unauthorized emails sent from the account.
• Notify recipients if phishing emails were sent from the compromised account.

4. Scan for Malware or Keyloggers

• Run a full antivirus scan on devices used to access the compromised email.
• Update all security software and perform system updates.