If you are searching for email hacked what to do, the first priority is simple: regain control of the account, change the password, and stop the attacker from using your email to access other accounts. After that, check your recovery settings, sign-in sessions, inbox rules, and linked services, then warn contacts if needed.
Email accounts are often the key to everything else: banking, shopping, social media, cloud storage, work tools, and password resets. That is why a hacked email account needs a calm but fast response. The steps below are written in plain English and work for most email providers.
Email hacked what to do first
If you only do a few things in the first 15 minutes, do these:
- Try to sign in from the provider’s official website or app. Do not use links from emails or messages. Type the address yourself or use a trusted bookmark.
- Change your password immediately if you still have access.
- Turn on two-factor authentication if it is not already enabled.
- Check recovery options such as backup email addresses, phone numbers, and security questions.
- Sign out of other sessions and devices from the account security page.
- Look for suspicious inbox rules, filters, forwarding, or app access.
- Change passwords for any accounts linked to that email address, especially financial, shopping, cloud, and social accounts.
If you cannot sign in because the password has been changed, go straight to the provider’s account recovery process. Most major providers have a recovery page for compromised accounts.
Security warning: only use the official website or app of your email provider. Search results, pop-ups, and messages after an account breach can lead to phishing pages designed to steal more information.
How to tell whether your email has been hacked
Sometimes the signs are obvious. Sometimes they are subtle. Common warning signs include:
- You cannot sign in with your usual password.
- Your contacts say they received strange messages from you.
- There are password reset emails you did not request.
- Your sent, trash, or archive folders contain messages you do not recognize.
- Inbox rules, filters, or forwarding addresses have appeared without your approval.
- Your account recovery email or phone number has been changed.
- You see unknown devices, locations, or apps on the recent activity page.
- You receive alerts about logins from new locations or devices.
Not every alert means someone broke in. You may have signed in from a new device, used a VPN, or triggered an automated security check. But if more than one sign appears, treat it as a real compromise until you confirm otherwise.
If you still have access to the account
1. Change the password right away
Create a new password that is long and unique. A good approach is a passphrase made from several unrelated words, or a password generated by a password manager.
Avoid reusing an old password or a password used on any other site. If one account was breached elsewhere, reused passwords let attackers move easily from one service to another.
2. Enable two-factor authentication
Two-factor authentication adds a second check after the password. That might be an authenticator app, a hardware security key, or a one-time code. Authenticator apps and security keys are generally stronger than text messages, though the available options vary by provider and region.
Save backup codes in a safe place, preferably offline.
3. Review account recovery settings
Attackers often change recovery details so they can return later. Check:
- Recovery email address
- Recovery phone number
- Security questions, if your provider still uses them
- Trusted devices
Remove anything you do not recognize.
4. Sign out everywhere
Most email providers let you sign out of all sessions or revoke access from specific devices. Use that feature. It prevents someone who is already logged in from staying connected after you change the password.
5. Check mailbox settings for backdoors
This step is easy to miss, and it matters. Attackers often create quiet ways to keep watching your email. Check for:
- Forwarding addresses sending copies of your mail elsewhere
- Rules or filters that hide, delete, archive, or move certain messages
- Auto-replies you did not create
- Connected apps with mailbox access
- POP, IMAP, or other mail access settings changed without your knowledge
Delete or disable anything suspicious.
6. Review recent account activity
Look for unfamiliar devices, browsers, locations, or IP addresses. You may not recognize every detail, but obvious anomalies are worth action. If your provider allows it, revoke access from those sessions.
If you cannot access the account
If the attacker has locked you out, work through the recovery process methodically.
1. Use the provider’s official recovery page
Start from the provider’s homepage, not from an email link. Look for options such as Forgot password, Account recovery, or My account was compromised.
2. Provide as much accurate information as you can
You may be asked about:
- Previous passwords
- Recovery email or phone number
- Approximate date you opened the account
- Devices you normally use
- Recent contacts or folder names
Answer carefully. Guessing wildly can make recovery harder.
3. Check whether recovery details were changed
If your provider alerts you that the backup email or phone number was recently updated, there may be a short period to reverse that change. Act quickly if you see that option.
4. Secure the device you use for recovery
If your email was stolen because of malware or a fake login page, recovering it on an infected device can expose the new password again. Before retrying recovery:
- Update your operating system and browser
- Run a trusted malware scan
- Remove suspicious browser extensions
- Restart the device
- Use a different trusted device if possible
Data security warning: if you suspect spyware, keylogging, or remote access malware, avoid entering new passwords until the device has been checked and cleaned.
Secure your other accounts immediately
Your email account is the reset point for many other services. Once an attacker controls it, they may try to reset passwords elsewhere.
Priority accounts to secure
- Banking and payment accounts
- Main cloud storage and device accounts
- Shopping accounts with saved payment details
- Social media and messaging apps
- Work or school accounts
- Password manager account, if you use one
Change passwords starting with the most sensitive services. Enable two-factor authentication where available. Review login history, active devices, and saved payment methods.
Look for signs of fraud or account changes
Check for:
- Unknown password reset confirmations
- New shipping addresses or profile changes
- Messages sent from your social accounts
- Unexpected purchases or subscriptions
- Cloud files shared or deleted without your knowledge
If you find suspicious activity in a financial or work account, contact the service provider through official support channels right away.
Tell the right people
Not every email breach requires a public announcement, but some quick notifications can limit damage.
Warn your contacts if spam or phishing was sent
If attackers used your account to email other people, send a short follow-up once the account is secure. Tell contacts not to click earlier links or open attachments from the suspicious messages.
Keep it simple. For example: your account was compromised, it is now secured, and any unusual message sent earlier should be ignored.
Inform your workplace or school if relevant
If the account is tied to an organization, report it to the IT or security team. They may need to revoke sessions, monitor for suspicious logins, or alert others. This is especially important if sensitive documents, customer details, or internal systems may have been exposed.
Contact critical service providers if necessary
If your email account was used to alter important accounts, contact those providers directly using their official support pages. This may include payment services, cloud providers, or telecommunications accounts, depending on what is linked to your email address.
Check for damage inside the inbox
Even after you regain control, spend a little time reviewing what the attacker may have seen or changed.
Search for password resets and security alerts
Use your inbox search to look for terms like:
- reset password
- security alert
- new sign-in
- verification code
- recovery
This can reveal which other accounts were targeted.
Check deleted, archived, and sent folders
Attackers often try to hide traces by deleting warning messages or moving them out of sight. Review:
- Trash or deleted items
- Archive
- Spam or junk
- Sent items
- Drafts
If your provider supports message restore, recover anything important that was removed recently.
Review connected apps and permissions
Some breaches happen through third-party access rather than the mailbox password itself. Remove any app or service you do not recognize or no longer use. Then reconnect only the tools you trust.
How your email may have been hacked
Knowing the likely cause helps prevent a repeat. Common routes include:
- Phishing: you entered your password on a fake sign-in page.
- Password reuse: the same password was exposed in another breach.
- Weak password: the password was guessed or cracked.
- Malware: a keylogger or info-stealing program captured your login details.
- Third-party app abuse: a connected app had too much access or was compromised.
- Shared device exposure: someone used a device where you were still signed in.
If you are unsure, assume more than one issue may be involved. For example, phishing and weak device security often overlap.
How to prevent it happening again
A few habits make a big difference.
Use a password manager
A password manager helps you create and store unique passwords for every account. That reduces the risk from password reuse and makes phishing easier to spot, because the manager usually will not auto-fill on the wrong site.
Turn on two-factor authentication everywhere important
Start with email, banking, main cloud accounts, and social accounts. Save backup codes securely.
Keep devices and browsers updated
Install security updates promptly. Old software can leave you exposed to known vulnerabilities.
Be cautious with login links
If an email says there is a problem with your account, do not click the sign-in link in the message. Open the provider’s official site yourself and check from there.
Review account activity from time to time
You do not need to do this weekly, but occasional checks of recent sign-ins, connected apps, and recovery settings are worthwhile.
Separate critical accounts where possible
Consider using one email address for highly sensitive accounts and another for routine sign-ups. This will not stop attacks by itself, but it can reduce the impact of a breach.
Frequently asked questions
How long does it take to recover a hacked email account?
It depends on the provider, the proof available, and whether the attacker changed recovery details. Some accounts can be recovered in minutes; others take longer if manual review is needed.
Should I change all my passwords if my email is hacked?
You should change the password for the email account immediately and then change passwords for any accounts linked to it, especially sensitive ones. If you reused the same password anywhere else, change those accounts too.
Can someone hack my other accounts through my email?
Yes. Email is often used for password resets, identity checks, and security alerts. That is why securing linked accounts quickly is so important.
Do I need to scan my computer or phone for malware?
If you do not know how the breach happened, yes. Scan your device, update the system, and remove suspicious apps or browser extensions before entering new passwords, especially if you suspect phishing or spyware.
Should I tell my contacts that my email was hacked?
If suspicious messages were sent from your account, yes. A short warning can stop others from clicking malicious links or opening harmful attachments.
Conclusion
If your email account is hacked, speed matters more than panic. Secure the account, reset related passwords, remove backdoors like forwarding and filters, check for wider account changes, and harden your setup with unique passwords and two-factor authentication. Once the urgent steps are done, a careful review of your devices and connected accounts will help you close the gap that let the attacker in.
