An email account was taken over

Signs include sent mail the owner didn't write, odd sign-in alerts, missing emails or contacts asking about strange messages. Lock the attacker out first, then work out what they did.

Get help Bring in an expert now if

It's an admin account, or the attacker changed tenant-wide settings.
Payment or bank details were changed, or an invoice was paid to a new account. Call the bank straight away: recalls work best within hours.
Several accounts show the same signs.

0 of 17 done

Right now

Block sign-in for the account while you investigate.
Microsoft recommends disabling the account first. If you can't, go straight to the password reset.
Reset the password from a trusted device, and sign the account out of all sessions.
Revoking sessions ends access the attacker already has. Don't send the new password by email: they may still be reading it.
Remove MFA methods and app passwords the owner doesn't recognise, then have them re-register MFA.
App passwords aren't revoked by a password reset.

Contain

Remove forwarding addresses and inbox rules the owner didn't create, including hidden rules, especially ones that move, delete or mark mail as read.
Attackers hide replies from the real owner, often for mail about invoices or payments.
Check third-party apps the account granted access to (OAuth consents), and remove any that are unfamiliar.
An app consent keeps working after a password reset.
Check delegates and shared access on the mailbox, and remove any that were added recently.
Check the account's admin roles, and remove any it shouldn't have.

Investigate

Review the sign-in logs: when the attacker first got in, from which IP addresses, and how.
Open the IOC lookup
Read the sent items and deleted items for what the attacker sent, especially to finance contacts or customers.
Check whether files were shared, downloaded or deleted from the account's cloud storage.
Find the way in: a phishing email (check its headers), a reused password from another breach, or an MFA prompt approved by mistake.
Open the email header analyzer

Recover

Warn the people the attacker emailed, by phone or a separate channel, so they don't act on the messages.
Confirm any recent changes to bank details or invoices with the other party by phone, using a number you already had.
Restore deleted mail or files if needed, then let the owner back in with fresh credentials and MFA.

Afterwards

Turn on phishing-resistant MFA (passkeys or security keys) for this account, and for admins and finance first.
Set up alerts for new forwarding rules and for sign-ins from unusual locations, if your platform supports them.
Write a short timeline: first sign-in, what changed, when you contained it.
Personal data may have been exposed: some laws set short deadlines to notify a regulator (72 hours under GDPR) or the people affected. Bring in whoever handles legal or privacy early.

Sources and further reading

This checklist was checked against these public guides, which go into more depth. Bluebench isn't affiliated with them.

General guidance, not a substitute for your own incident response plan or professional help. Your ticks stay on this page only and aren't saved.