Get your hacked business email back under control.
Customers get odd emails from you. Someone asks them to pay an invoice to new bank details. Replies go missing, you see sign-ins you don’t know, or you can’t get in at all. These are signs someone got into a business mailbox. We lock them out, find and remove what they left behind, check what was sent, and help you warn the people who need to know.
What we look for in the mailbox, once you give us access.
Sign-ins from places you don’t knowFOUND
Hidden forwarding to an outside addressFOUND
Inbox rule moving replies out of sightFOUND
Sign-in codes turned onOFF
Example only, not a real client’s results.
Who it’s for
Small businesses on Microsoft 365 or Google Workspace, or using Outlook.com or Gmail for business. Especially if customers get odd emails from you, someone asked to change invoice or bank details, replies are missing, you see sign-ins you don’t know, or you are locked out.
Why this matters
The emails come from your real mailbox.
Customers and partners trust email from you. So when someone gets into your mailbox, they can fool the people who know you best.
WHAT IT LOOKS LIKE
The emails look like they came from you
Microsoft says attackers often use a hacked mailbox to send email to people inside and outside the business. It comes from your real address, so a request to pay an invoice to new bank details can look just like your normal emails. In 2025 the FBI’s Internet Crime Complaint Center received 24,768 business email compromise complaints, with reported losses of $3,046,598,558.
Someone who gets in can set up hidden forwarding, inbox rules that move replies out of sight, or give an outside app access to the mailbox. Those stay in place until someone finds and removes them, so we look for each one.
We can’t get money back. That is up to your bank and law enforcement, so call your bank first if money was sent. Keep the evidence: don’t delete the mailbox or the odd emails, even if you want to start fresh. If customer personal information may have been exposed, rules about telling people may apply. Ask your attorney. We don’t give legal advice.
How it works
Talk it through. Lock them out. Make it harder next time.
We start with a short call about what you are seeing. Then, with access you set up for us, we lock the attacker out, find what they changed and help you tell the people who need to know.
Already have an IT company? We can work alongside them. You don’t have to replace anyone.
1
Talk it through
A short, free call. We go through what you are seeing and tell you the first steps. On the free check we don’t log in to anything and we don’t ask for passwords.
2
Lock them out and clean up
We reset passwords, sign out every session and turn on sign-in codes. We remove hidden forwarding, inbox rules and app access you don’t know, and check what was sent and from where, as far as the records show.
3
Warn people, then prevent it
We help you warn customers and partners, and give you a dated, plain summary to share with your bank, insurer or attorney. Then we turn on sign-in codes for every account, and alerts where your plan allows.
What you can buy
Lock them out. Then make it harder next time.
Start with the free check. Then we lock the attacker out, find out what happened, and make every account harder to get into.
01 / LOCK OUTStart here
Attacker locked out
The first job: cut off their access.
Passwords reset and every session signed out
Sign-in codes turned on for the hacked account
Hidden forwarding, inbox rules and unknown app access removed
You get: a dated list of what we reset, signed out and removed.
02 / FIND OUTWhat happened
What was sent, and from where
So you know who to warn.
Sign-ins and sent email checked, as far as your plan keeps the records
A short message to warn customers and partners, written with you
A dated, plain summary for your bank, insurer or attorney
You get: a dated summary you can share.
03 / PREVENTAfter the cleanup
Harder to get into next time
Every account, not just the one that was hacked.
Sign-in codes on every account
Alerts turned on, where your plan allows
A short list of what else to tighten, in plain words
You get: a list of each account and how it is protected.
The price depends on how many mailboxes and accounts are involved and which email service you use. You get the price in writing after the free check.
Your incident summary
What happened. What we did.
A dated summary in plain words, to keep and to share with your bank, insurer or attorney.
What we found
Unknown sign-ins, forwarding, inbox rules and app access, and when we found them.
What was sent
Emails sent from the mailbox that you didn’t write, as far as the records show.
What we changed
Each step with its date: passwords, sessions, sign-in codes and what we removed.
Othex / Sample incident summarySample
Business mailbox: this cleanup
Sample layout, not a real client’s results.
Unknown sign-ins foundCOUNT
Forwarding and inbox rules removedLIST
Unknown app access removedLIST
Sign-in codes on every accountSTATUS
Every step is dated, so you can show your bank, insurer or attorney what was done and when.
Free hacked email check
Think your business email was hacked?
Ask for a free hacked email check. It is a short call: we go through what you are seeing and tell you the first steps. On the free check we don’t log in to anything and we don’t ask for passwords. No cost and no obligation.
If money was sent, call your bank first, then us.
If you want our help after that, you get what we’ll do, the timing and the price in writing before you pay anything.
Tell us which email service you use, like Microsoft 365 or Google Workspace, and what you are seeing. If you can, write from an address that wasn’t hacked. Please don’t send passwords.
Plain answers about what we can fix and what we can’t.
Do you need my email password?
Not for the free check. For the cleanup, we walk you through each step on a call while you are signed in, or you add us as a user with our own sign-in, so you never share yours. Please don’t send passwords in the form or by email.
Can you get our money back?
No. That is up to your bank and law enforcement. If money was sent, call your bank right away. Our dated summary can help you show them what happened.
Should we delete the hacked mailbox and start over?
Please don’t. The mailbox and the odd emails are evidence your bank, insurer or attorney may need. We lock the attacker out and clean up the mailbox instead.
Do we have to tell our customers?
If odd emails went out, warning customers and partners helps stop them paying the wrong account. We help you write that message. If customer personal information may have been exposed, rules about telling people may apply. Ask your attorney.
We use Outlook.com or Gmail, not a business plan. Can you help?
Yes. Some settings and alerts only come with business plans, so we tell you plainly what your account can and can’t do, and walk you through each step.
Does this help with our cyber insurance?
The dated summary can be part of what you share with your insurer. Our cyber insurance renewal service helps you answer the security questions on your renewal form with proof. We don’t sell insurance.
Our real emails land in spam. Is that the same problem?
No. This page is about someone getting into a mailbox. If your own emails land in spam or never arrive, see our page on emails that reach the inbox.
What about our files?
If the same account opens your shared files, we tell you what to check. Our backup service makes sure you could get your files back if something was changed or deleted.
What does it cost?
The free check costs nothing. The cleanup and the prevention steps are quoted after it. The price depends on how many mailboxes and accounts are involved. You get the price in writing before you pay anything.