Customers report strange messages from your address, you get warnings about unknown sign-ins, or emails disappear from your inbox. At that point every hour counts.
How to tell your account has been compromised
- Contacts receive messages you did not write.
- The Sent folder contains emails you never sent, or it has been emptied.
- You see sign-ins from countries you have not been to.
- Replies to your emails stop arriving because they are being redirected.
The first 30 minutes
- Change the password from a device you trust. If your own computer is infected, the attacker sees the new password straight away.
- Sign out all sessions. Most providers can log out every connected device at once.
- Turn on two-factor sign-in if it is not active yet.
- Check the rules. Attackers like to create forwarding or inbox rules that quietly copy or delete emails. These rules survive a password change.
- Remove connected apps you do not recognise.
Warn customers and partners
Hijacked mailboxes are often used for invoice fraud: the attacker reads along, waits for an open invoice and then sends a «new bank account» in your company's name. Briefly inform your key customers and ask them to always confirm changes to payment details with you by phone.
Find out how it happened
Without the cause, it happens again. The most common routes are a fake sign-in page, a password that was also used on another, breached service, or malware on a device. Have the affected devices checked before you sign in on them again.
Report the incident
In Switzerland, cyber incidents can be reported to the Federal Office for Cyber Security (BACS). If money has been lost, the case also belongs with the police. If customers' personal data was affected, check whether the Data Protection Act requires a report to the Federal Data Protection and Information Commissioner. When in doubt, get professional advice.
So it does not happen again
Two-factor sign-in for every mailbox, a password manager instead of reused passwords and a short training on fake emails prevent most of these cases. More in our guide IT security for SMEs in Valais.
Has it just happened to you? Call +41 79 122 10 94 or see our IT services.