Your Email Was Hacked—Now What? A Cybersecurity Expert‘s Step-by-Step Guide

Email hacking is one of the most prevalent and damaging forms of cybercrime today. According to the FBI‘s Internet Crime Report, email account compromise resulted in over $2.4 billion in losses for Americans in 2021 alone. And a recent study by Google and Stanford University found that a staggering 20% of all email accounts have been hacked at some point.

When malicious actors gain unauthorized access to your email account, the consequences can be severe. Hackers can use your account to send spam and scam messages to your contacts, steal sensitive personal information like financial records and passport numbers, access your other online accounts, and even impersonate you to commit crimes. Many major data breaches start with a single compromised email.

As a cybersecurity consultant with over 10 years of experience dealing with email hacking incidents, I‘ve seen firsthand how devastating these intrusions can be for both individuals and organizations. In this guide, I‘ll share expert tips on how to recognize if your email account has been breached, immediate actions to take to mitigate the damage, and long-term strategies to reduce the risk of future hacks.

Red Flags: How to Tell If Your Email Has Been Hacked

The first step in responding to a potential email hack is confirming that unauthorized access has actually occurred. Keep an eye out for these common signs that your email account has been compromised:

1. You can‘t log into your account. One of the first things many hackers do is change your account password to lock you out. If your correct password suddenly stops working, that‘s a big red flag.

2. There are unfamiliar sent messages. Check your sent folder for messages you don‘t remember sending, especially if they contain spam or phishing content. Hackers often use compromised accounts to blast out malicious emails.

3. Your contacts receive strange emails from you. If your friends and colleagues report getting suspicious messages that appear to be from your account, take it seriously. The hacker may be using your email to spread scams or viruses.

4. You see unexpected password reset messages. If you receive password reset notifications for your email account or other linked accounts that you didn‘t request, a hacker may be trying to take them over.

5. Unfamiliar devices and locations appear in login activity. Check your email account‘s security settings or recent activity log (see instructions below). If you see logins from unknown devices, IP addresses, or locations, your account may be breached.

If you notice one or more of these signs, you should assume your email has been hacked and take immediate action to secure your account. The sooner you can lock out the intruder, the less damage they can do.

Immediate Incident Response: What to Do As Soon As You Discover the Hack

When you realize your email account has been compromised, quick response is critical to minimize the fallout. Here are the key steps cybersecurity pros recommend taking ASAP:

1. Change your account password.

Your absolute first move should be to log in to your email account (if you still can) and change the password to a new, strong one that the hacker couldn‘t guess. A good password should be long (at least 12 characters), use a mix of characters (upper and lowercase letters, numbers, and symbols), and not be used for any other accounts. Don‘t include any personal information or dictionary words.

Unsure if your new password is secure enough? Test its strength with an online password checker like How Secure Is My Password?. If you have trouble remembering complex passwords (and most of us do), consider using a reputable password manager like LastPass or 1Password to generate and securely store uncrackable credentials.

"The number one thing you can do to prevent a bad situation from getting worse is change your password as soon as you suspect your email has been hacked. This locks the intruder out of your account before they can do more damage or steal additional information."

– Jeremy Tillman, Director of Product Management at Ghostery

2. Set up two-factor authentication.

Sometimes hackers can regain entry to your account even after you‘ve changed the password, especially if they‘ve installed stealthy malware on your device. Adding an extra layer of security called two-factor authentication (2FA) can help block their repeated attempts.

With 2FA enabled, signing into your email account requires an additional one-time code generated by an app or sent to your phone number, on top of your username and password. So even if the hacker knows your login credentials, they still can‘t access your account without that second code.

Most major email providers offer 2FA in the account settings:

• Gmail: Go to myaccount.google.com > Security > 2-Step Verification. You can set up 2FA via SMS text message or Google Authenticator app.

• Outlook: Click the Settings gear icon > View all Outlook settings > Security. Under Two-step verification, click Enable.

• Yahoo Mail: Sign in at login.yahoo.com > Account security > Two-step verification > Turn on.

• Apple (iCloud): On an Apple device, go to Settings > [your name] > Password & Security. Tap Turn On Two-Factor Authentication.

I strongly recommend using an authenticator app like Google Authenticator or Authy for 2FA codes rather than SMS messages. Text codes can be intercepted by determined hackers, while authenticator codes are much harder to steal.

3. Check your account recovery options and backup email.

While you have access to your email account, review and update the recovery options like backup email addresses, phone numbers, and security questions. If you see any options you didn‘t set up, the hacker may have added them to maintain access. Remove any recovery methods you don‘t recognize or no longer have access to.

It‘s also a good idea to set up a dedicated backup email address that you only use for account recovery, in case your primary email gets hacked again in the future. Choose a completely different email provider than your main account (e.g., if you use Gmail for your primary email, use Outlook or Yahoo for your backup). Use a strong, unique password and enable 2FA on this backup account as well.

4. Scan all your devices for malware.

In some cases, hackers gain access to email accounts by planting malicious software like keyloggers directly on your devices. To rule out this possibility, run a full virus scan on all the computers and mobile devices you use to access your email.

"Some of the most insidious email breaches happen when malware on the victim‘s device silently captures their login credentials in the background. Scanning for and removing any malware should be an urgent priority for anyone dealing with a suspected email hack."

– Pieter VanIperen, Managing Partner at PWV Consultants and Adjunct Professor of Cybersecurity at NYU

Be sure to use a reputable, comprehensive antivirus program when scanning for threats—the free tools built into Windows and macOS don‘t always catch the most sophisticated malware. If you don‘t currently have antivirus software installed, consider a highly-rated paid option like Norton 360, Bitdefender Total Security, or Malwarebytes Premium.

5. Log out of your email on all other devices and sessions.

As a final precautionary step, fully sign out of your email account everywhere except for your current device. This ensures the hacker can‘t maintain access from any devices where they may have already logged in.

On Gmail, you can view and log out other active sessions under Security > Your Devices. For Outlook, go to Settings > Security > Active sessions. Other email providers have similar options to remotely sign out all other web browser and app sessions.

Crucial Next Moves: How to Contain the Damage and Prevent Future Hacks

Locking down your email account is a great first response to a hack, but the work doesn‘t stop there. You‘ll need to take additional action to assess and control the fallout, both to your own identity and your contacts who may have been exposed. Here are the critical next steps:

Determine what was compromised.

Depending on the extent of the hack, the perpetrator may have gained access to a trove of sensitive personal information from your emails and attachments, like your Social Security number, financial accounts, home address, medical records, passport, or tax returns. If you have emails containing private data like this, you should assume they‘ve been breached.

Hackers can leverage stolen info like this to commit full-blown identity theft in your name: opening new credit accounts, filing fake tax returns, or even impersonating you to commit other crimes. The more of your data they have, the more dangerous the situation.

Perform a thorough review of account activity.

To get a sense of how much damage was done, comb through your email activity logs as far back as you can (unfortunately most providers only keep detailed logs for 30 days or less). Check for any suspicious actions you don‘t recognize, like:

• Emails sent that you didn‘t write
• Contacts or email forwarding addresses added
• Changes to security settings like backup email or password
• Mass deletions of messages or folders
• Emails opened that contain sensitive information

This can give you clues to the hacker‘s movements and help you understand the severity of the breach. In a worst case scenario, you may need to contact your email provider‘s support team for assistance with remediation.

Alert your email contacts and label external accounts.

If you found evidence that the hacker used your account to send spam or scam messages to your contacts, you‘ll need to send a follow-up message explaining the situation. Apologize for any suspicious emails that came from your account and instruct your contacts not to click any links or open any attachments they received during that period.

You should also be on high alert if you have any other accounts linked to your compromised email address, like your banking login or social media profiles. The hacker may use the "Forgot Password" feature to reset credentials for these accounts using your email. Check for any password reset notifications you don‘t remember requesting.

Go into these linked accounts and remove your compromised email address if possible, or at least label it to remind you not to use it for security-critical correspondence going forward. You may even want to proactively change the passwords for your most sensitive external logins.

File an official report and consider a credit freeze.

If you believe your email hack is part of a larger identity theft attempt, you can file a formal report with your local police department and the FBI‘s Internet Crime Complaint Center at www.ic3.gov.

You should also place a free fraud alert on your credit reports with the three major credit bureaus. This encourages businesses to take extra identity verification steps before granting new accounts in your name. For maximum protection, you can even put a freeze on your credit file, which entirely prevents anyone from opening new credit in your name until you lift the freeze.

"A single compromised email account can quickly snowball into full-scale identity fraud if hackers gain enough of a foothold. It‘s every consumer‘s responsibility to monitor their credit report and know the warning signs of identity theft so they can shut it down immediately."

– Eva Velasquez, President/CEO at Identity Theft Resource Center

Implement lasting email security best practices.

While there‘s no such thing as a completely hackerproof email account, you can limit your vulnerability to future breaches by making these expert-recommended security measures a standard part of your routine:

• Use a unique, randomly generated password for your email account. Your email password should be long, complex, and not reused anywhere else. Consider using a password manager to keep track of all your credentials.

• Always enable two-factor authentication. 2FA is the single most effective way to stop unauthorized email access, even if a hacker gets ahold of your password. It only takes a few minutes to set up and could save you from a world of hurt down the line.

• Audit and improve your email security settings. Periodically review your email account‘s privacy and security settings to make sure they‘re configured for maximum protection. Most providers include options to notify you of unrecognized logins, show and log out active sessions, restrict third-party app access, only allow trusted senders, and more. Learn what security features are available and enable them.

• Learn to spot phishing and social engineering. The most common way hackers break into email accounts is by tricking victims into revealing their login credentials through fraudulent messages. Familiarize yourself with the telltale signs of phishing emails and always be wary of unsolicited messages asking you to click a link, download an attachment, or provide personal info. If you‘re unsure if a message is legitimate, contact the supposed sender directly through a different channel to confirm.

• Keep your devices and apps updated. Hackers exploit security vulnerabilities in outdated software to secretly access victims‘ accounts. Enable automatic updates for your device operating systems, email apps, web browsers, and any plugins or extensions you use. The most recent software versions have patches for known security holes.

• Always log out of email on shared devices. If you need to access your email on a shared computer like a library or hotel business center, always fully log out of your account when you‘re done. Don‘t just close the browser window. You don‘t want to accidentally leave your account wide open for the next person who uses that machine.

• Consider switching to a security-focused email provider. Some email services go above and beyond when it comes to protecting users‘ privacy and security. For example, ProtonMail and Tutanota offer end-to-end encryption, meaning even the providers themselves can‘t read your messages. Hushmail and CounterMail route email through private, secured networks. If you‘re willing to pay a few bucks a month, these services can provide greater peace of mind.

The unfortunate reality is that email hacking isn‘t going away anytime soon. As our inboxes become more and more central to our digital lives, they will only become juicier targets for cybercriminals. But by knowing how to quickly detect and decisively respond to potential breaches, we can contain the damage and bounce back stronger. Staying alert and following email security best practices can go a long way toward preventing a devastating hack before it even happens.