My business email has been hacked: what to do now (UK SME guide 2026)

Small firms are hacked through email more than any other way. The attacker usually wants one of two things. To send emails that look like they come from you. Or to watch your inbox until an invoice is due, then change the bank details.

The NCSC has a short guide to recovering a hacked account. This guide turns it into steps for owners with no IT team, using Microsoft 365 or Google Workspace. It reduces harm. It cannot undo everything.

Signs your email has been hacked

• Clients or suppliers get emails from you that you did not send.
• Password reset or sign-in alert emails you did not ask for.
• Emails are missing, or replies go straight to a folder you never use.
• New inbox rules or forwarding to an address you do not know.
• Your sent folder has messages you did not write, or is suddenly empty.
• You cannot log in, or your password no longer works.

If you see any of these, treat it as real. Act now and check later.

The first hour

1. Take the account back

Change the password from a device you trust, not the one you think was used. Use a long, new password you have never used anywhere else.

Microsoft 365: in the admin centre, go to Users, then Active users. Reset the password and choose Sign out of all sessions. Microsoft's guide to responding to a compromised email account lists the full steps.

Google Workspace: an admin can reset the password and the user's sign-in cookies in the Admin console. Google has a guide to securing a compromised account. For a personal Gmail, use Google's hacked account steps.

If you are locked out completely, use the provider's recovery process. If you have an admin, they can reset it for you.

2. Turn on MFA, or reset it

MFA (multi-factor authentication) is the second check at sign-in, such as a code from a phone app. If it was off, turn it on now. If it was on, check the registered methods. Attackers sometimes add their own phone. Remove anything you do not recognise. See our guides to MFA for Microsoft 365 and authenticator apps for staff.

3. Check forwarding and inbox rules

This is the step most people miss. Attackers often add a rule that forwards your email to them, or hides replies from a client. Changing the password does not remove these rules.

In Outlook, check Settings, then Mail, then Rules and Forwarding. In Gmail, check Settings, then Filters and Blocked Addresses, and Forwarding. Delete anything you did not set up. Note down what you found first.

4. Change passwords on linked accounts

Your email is the key to everything else. Anyone with your inbox can reset other passwords. Change the password on anything that uses the same password, and on your banking, accounts software, and domain registrar.

If you reused the hacked password anywhere, change it there too. You can check whether your email address appears in known breaches at Have I Been Pwned.

A password manager makes this much easier. Every account gets its own password, so one hack does not spread. Read how to stop staff reusing passwords or compare options in our password manager guide and our NordPass vs 1Password vs Bitwarden comparison.

Stop the money going missing

This is where the real losses happen. If the attacker could read your email, they may know about invoices you are about to pay or send.

• Call your bank if you think a payment went to the wrong account. Do it straight away. The sooner the bank knows, the better the chance of getting money back.
• Warn your accounts team or bookkeeper. No changes to bank details without a phone call to a known number.
• Tell clients who pay you. Say your bank details have not changed, and that they should call you before paying any new details.
• Check recent invoices in your sent folder for edits you did not make.

Our guide to fake change of bank details emails explains how this fraud works and how to stop it.

Tell people

Clients and suppliers

Send a short, calm email to people you deal with often. Something like: "Our email account was misused on [date]. If you got an unusual message or a request to pay new bank details, please ignore it and call us on [number]." Ring your most important clients too.

Your staff

Tell the team what happened and what to look out for. If one account was hacked, others may have had the same phishing email. Our guide to the first hour after a phishing click covers that side.

Report it

• Fraud or money lost: report it to Report Fraud, the UK police service that replaced Action Fraud.
• The phishing email: forward suspicious emails to the NCSC. See how to report a scam email.
• Personal data at risk: decide whether it is a personal data breach. Some breaches must be reported to the ICO within 72 hours of you becoming aware.

In the week after

• Read the sign-in history. Look for sign-ins from places or devices you do not know. Note the dates.
• Check what was sent. Look through the sent and deleted folders for emails the attacker sent.
• Check the other accounts. Make sure nobody else on the team shows the same signs.
• Review admin rights. Remove admin access from anyone who does not need it.
• Keep a simple log of what happened, what you did, and when. You will need it for your bank, your insurer, or the ICO.
• Tell your insurer if you have cyber insurance. Many policies want to hear about incidents quickly.

Our guide to the week after a phishing click has more on the clean-up.

When to get help

Get help from an IT professional if any of these apply:

• You cannot get back into the account.
• Money has been lost, or a client paid the wrong account.
• The hacked account was an admin account.
• You find signs on more than one account.
• You are not sure what the attacker saw or changed.

This guide is general information, not legal or IT advice.

How to stop it happening again

• Turn on MFA for everyone. It blocks most password attacks. Microsoft explains how to set up MFA in Microsoft 365.
• Use a different password for every account. A password manager does this for you.
• Agree a call-back rule for any change to bank details.
• Check forwarding rules every few months.

Not sure where you stand? Try our free exposure checker. Ten yes or no questions. About two minutes.

Copyable hacked email checklist

FAQ

How do I know if my business email has been hacked?

Common signs are clients getting emails you did not send, password reset emails you did not ask for, new forwarding or inbox rules, missing emails, and sign-in alerts from places you have not been. One sign is enough to act.

Should I just delete the hacked email account?

No. You would lose the evidence and the client emails you still need. Take the account back, clean it up, and keep it running.

Do I have to report a hacked email account to the ICO?

Only if personal data was put at risk and the breach is likely to cause a risk to people. Many hacked mailboxes do hold client personal data, so think it through and keep a note of your decision. If you must report, you have 72 hours from when you became aware.

My email is sending spam to my contacts. What should I do?

Treat it as a hacked account, not just spam. Reset the password, sign out all sessions, turn on or reset MFA, and check for forwarding rules. Then send a short note to contacts telling them to ignore the messages and not to pay any new bank details.

Sources we checked

• NCSC: Recovering a hacked account
• NCSC: Small organisations guide to cyber security
• Microsoft: Responding to a compromised email account
• Google: Secure a hacked or compromised Google Account
• ICO: Report a breach

Bottom line

Take the account back, turn on MFA, and delete any rules the attacker added. Then protect the money: call the bank and warn the people who pay you. Tell people, report it, and keep a log. Give every account its own password so one hack stays one hack.