Microsoft 365 Email Hacked? Help With a Compromised Account
Contain it, find out what happened, and close the way back in.
If someone is sending email as you, signing in from places you do not recognize, or asking your contacts for payments, I help small and mid-sized businesses contain the account, trace what the attacker did through the Microsoft 365 logs, and secure the tenant so the same attack is much harder to repeat.
Reply the same day or the next business day Microsoft Certified: Cybersecurity Architect Expert Microsoft 365 Administrator Expert Remote, from Vancouver, BC
Signs your Microsoft 365 account may be compromised
- Email sent from your mailbox that you did not write, or contacts asking whether a message really came from you
- Inbox rules you did not create, especially ones that move, hide, or delete messages
- Sign-ins from places or devices you do not recognize, or a device registered to your account that is not yours
- A new MFA method or phone number on your account that you did not add
- A client or partner says you asked them to change payment details
- Replies and bounce-backs that go missing
What to do right now
- 1
Do not pay or change payment details
Not until you have confirmed the request by phone, using a number you already had, never one from the email.
- 2
Call anyone with a payment in progress
Warn your bank and the clients or partners who might act on a fake email. Call them rather than emailing, because the mailbox may still be watched.
- 3
Reset the password and revoke sessions
An admin can reset the password and sign the account out of all sessions in the Microsoft 365 admin center or the Microsoft Entra admin center.
- 4
Do not delete the evidence
Keep suspicious emails, inbox rules, and sent items. Audit records and quarantined messages expire, so they need to be saved early.
- 5
If money was sent, contact your bank first
Then report it to the police. In Canada, you can also report fraud to the Canadian Anti-Fraud Centre.
- 6
Then deal with what a password reset leaves behind
A new password does not remove devices, MFA methods, inbox rules, forwarding, or app access an attacker added. That is where I come in.
How I help
- Triage
- A call to understand what you are seeing, then a first look at the affected accounts and what is still at risk.
- Containment
- Revoke sessions; remove the devices, MFA methods, and app permissions the attacker added; block or reset affected accounts; and stop forwarding to outside addresses.
- Investigation
- A timeline built from Microsoft Entra sign-in logs, the Microsoft Purview audit log, mailbox rules, and message traces: how long they were in, what they read, sent, and changed, and how they got in where the evidence shows it.
- Evidence
- Logs, messages, and recipient lists preserved before they expire, so your insurer, the police, or a lawyer can use them.
- Hardening
- The gaps that made the attack possible, closed: MFA for everyone, device and admin controls, and email protections, plus a plan for the next layer.
- A plain-language report
- What happened, what was exposed, what was clean, what changed, and the decisions only you can make, starting with who to call.
What this looks like in practice
A small business called me after a phishing email went out from their mailbox to thousands of contacts, even though MFA was on. The logs showed the attacker had been reading the mailbox for weeks and had already tried a payment fraud. I locked the tenant down the same day and gave the owner a plain-language plan. Read the full story.
What I do not cover
I focus on the Microsoft 365 tenant: identities, mailboxes, devices, apps, and settings. These are outside that scope:
- Formal digital forensics or expert reports for court
- Ransomware, or attacks on servers, networks, and computers outside Microsoft 365
- Round-the-clock monitoring or a security operations centre
- Legal advice, including decisions about reporting a privacy breach
- Recovering money that has already been sent
If your case needs one of these, or your cyber insurer requires its own response firm, I work alongside them on the Microsoft 365 side.
Frequently asked questions
My Microsoft 365 email was hacked. What should I do first?
Do not pay or change any payment details until you have confirmed them by phone. Call anyone with a payment in progress. Have an admin reset the password and revoke the account's sessions. Keep the suspicious emails and inbox rules as evidence. Then check for the devices, MFA methods, inbox rules, forwarding, and app access the attacker may have added, because a password reset does not remove them.
Is changing the password enough?
No. A password reset does not remove a device the attacker registered, an MFA method they added, inbox rules or forwarding they created, or an app they gave access to the mailbox. Each of those can let them back in or keep reading your mail.
How can my account be hacked if MFA is on?
MFA protects the moment of sign-in. If an attacker steals the session your browser or app received after you signed in, they can replay it without the password or an MFA prompt. Microsoft calls this token theft. Controls such as Conditional Access that requires a managed device, and phishing-resistant sign-in such as passkeys, make it much harder.
Can you tell what the attacker read?
Often, yes. The Microsoft Purview audit log can record which emails were opened, alongside Microsoft Entra sign-in logs and device registrations. Audit (Standard) records are kept for 180 days by default, so it is important to start soon. The result shows what the logs recorded, which is strong evidence but not a complete guarantee.
Do we have to report the breach?
It depends on your organization and what was exposed. If personal information was involved, Canadian privacy law may require you to report the breach and notify the people affected. I help you gather the facts; a lawyer or your privacy officer makes that decision.
How quickly can you help?
I reply to compromise requests the same day or the next business day, and work remotely. I do not run a 24/7 emergency line, so take the immediate steps on this page while you wait.
Will you work with our IT provider or insurer?
Yes. I can work alongside your IT provider or MSP, and if your cyber insurer requires its own incident response firm, I can support them on the Microsoft 365 side.
Related
Think your Microsoft 365 account is compromised?
Send a short note about what you are seeing and when it started. I reply the same day or the next business day. Please do not send passwords, codes, or log files through the form; we agree a safe way to share access once we start.
Ask for help