Email Hacked? What to Do Right Now

If your email account has been hacked, act immediately to secure it: change your password, sign out of all sessions, and check for unauthorized forwarding rules. Then scan your sent folder for spam, notify your contacts, and enable two-factor authentication to prevent a repeat. This guide walks through each step in order, explains how hackers get in, and answers the questions people ask most after an attack.

First Steps: Lock the Attacker Out

The moment you suspect your email is compromised, stop what you are doing and secure the account. Speed matters because the intruder may still be inside, reading your mail and using your identity.

1. Change your password immediately. Use a long, unique passphrase you have never used elsewhere. If the attacker already changed it, use the provider’s “forgot password” recovery process, which usually sends a code to your recovery phone or alternate email.
2. Sign out of all other sessions. Most providers (Gmail, Outlook, Yahoo, iCloud) have a “sign out of all devices” or “manage devices” option in the security settings. This kicks the hacker off instantly.
3. Check for forwarding rules. Attackers often set up a rule that silently copies every incoming message to their own address. Look in Settings → Forwarding (or Filters and Blocked Addresses) and delete anything you did not create.
4. Check recovery options. Make sure the attacker has not added their own phone number or backup email to your account. If they have, remove it.
5. Scan your sent folder. If the hacker sent phishing emails to your contacts, delete those messages so your recipients do not click malicious links.

Do these before you do anything else, even before you tell your friends. Every minute the attacker stays in costs you more control.

How Did This Happen? Common Attack Vectors

Understanding how your email got hacked helps you fix the root cause, not just the symptom. The most common methods in recent years are:

• Phishing: A fake login page that looks exactly like your provider’s. You type your password and the attacker captures it. Often arrives as an email saying “your account will be suspended” or “unusual sign-in detected.”
• Password reuse: You used the same password on a shopping site that got breached. Hackers take those leaked credentials and try them on email, banking, and social media. This is called credential stuffing.
• Malware or keyloggers: A malicious download on your computer records keystrokes, including your email password.
• Session hijacking: An attacker steals your login cookie (often via an unsecured Wi-Fi network) and uses it without needing your password at all.
• SIM swapping: The hacker convinces your mobile carrier to port your phone number to a SIM they control, then uses “forgot password” texts to reset your email.

If you cannot identify the cause, assume it was password reuse or phishing, because together those account for the vast majority of cases.

After Locking Down: What to Check Next

Once you have changed the password and removed forwarding rules, do a deeper sweep. Attackers often leave subtle traces you will miss if you only change the password.

• Check your sent and trash folders for messages you did not write. Delete them so your contacts do not receive follow-up scams.
• Review your account activity log. Gmail, Outlook, and Yahoo all show recent sign-in locations and IP addresses. Look for logins from unfamiliar countries or devices. Note the IP address and timestamp; your provider may ask for it when you report the incident.
• Check your email signature. Some hackers insert a phishing link into the signature so every email you send carries it.
• Verify your contact list. Attackers sometimes alter or delete contacts to make it harder for you to warn people.
• Look at your storage. If your account suddenly has large attachments you did not upload, the hacker may have stored files there.

If you use your email for online banking, change those passwords too, and check for any transactions you do not recognize. Email is the master key to your digital life; a compromised inbox often leads to compromised financial accounts.

Preventing It From Happening Again

Your old password is gone, but the habits that let the hacker in may still be there. The single most effective change is two-factor authentication (2FA). Even if someone steals your password again, they cannot get in without the second code.

• Turn on 2FA using an authenticator app (like Google Authenticator or Authy) rather than SMS, because SMS codes can be intercepted via SIM swapping.
• Use a password manager. It generates and stores a unique, random password for every site, so a breach on one site never affects your email.
• Never click links in unsolicited emails. If a message says “verify your account,” go directly to the provider’s website by typing the address yourself.
• Keep your recovery phone number and alternate email up to date. If you lose access, these are your lifeline.
• Update your computer and phone software to close security holes that malware exploits.

If you already had 2FA on and still got hacked, the likely cause was a session hijack or malware on your device. Run a full antivirus scan and consider using a different computer to change your passwords.

Should You Tell Your Contacts?

Yes, but do it carefully. If the attacker sent phishing emails from your account, your contacts may have already received a message that looks like it came from you. A quick, honest note prevents them from falling for the scam and lets them know to delete the suspicious email.

Send a simple message: “My email was hacked today. If you received a strange message from me, please delete it and do not click any links. I have secured the account.” Do not include any links in this warning message, because some email filters will flag it as suspicious.

If the attacker accessed sensitive personal information (like tax documents or medical records), you may also want to report the incident to your country’s cybercrime authority. In the US that is the FBI’s IC3; in the UK it is Action Fraud. This is optional for a simple hack, but useful if you suspect identity theft is underway.

Frequently Asked Questions

Can I recover my email if the hacker changed the password?

Yes, usually. Every major provider has a recovery process that lets you prove ownership via your recovery phone number, alternate email, or security questions. If you never set up recovery options, it is much harder, but you can still try contacting the provider’s support with proof of identity such as a government ID.

How do I know if my email was actually hacked?

Common signs: you cannot log in, your sent folder contains messages you did not write, your contacts report receiving spam from you, your password was changed without your action, or you see login attempts from unfamiliar locations in the activity log. Sometimes the only sign is a forwarding rule you did not create.

Should I change my password on other websites after email is hacked?

Yes, especially for any site that uses your email as the login. Start with your bank, social media, and shopping accounts. If you reused the same password anywhere, change those first. If you use a password manager, change the email password and then audit which other accounts share the old one.

What if the hacker used my email to reset other account passwords?

Check the password reset emails in your inbox and trash. If you see reset requests for services you did not initiate, log into those services and change their passwords immediately. The hacker may have already taken over those accounts, so act fast and use the “forgot password” flow to reclaim them.

Can a hacker read my emails even after I change the password?

If they set up an IMAP connection on their own device, changing the password usually revokes that access. But if they installed malware on your computer, they can still read anything you open. Run a full antivirus scan and consider logging in only from a clean device until you are sure.

Is it worth reporting the hack to my email provider?

Yes, especially if the attacker has access to sensitive data or you cannot fully regain control. Providers have abuse-reporting forms, and they can investigate whether your account is being used to send spam. Reporting also helps them protect other users from the same attack pattern.

Related

• FCC Internet Privacy Rules: Panic Justified?
• Alienware x15 x17 Launch Date & Specs
• Email Verification for Marketing Campaigns: What It Does and Doesn’t