Why Changing Your Email Password Isn’t Always Enough After a Cyberattack

If someone gains access to your business email account, change your password first. But many people don’t realize this: a new password doesn’t necessarily lock the attacker out.

Even after you’ve changed your password, someone could still have access to your emails through an active login session, an automatic forwarding rule, or a connected application.

That’s why securing a compromised email account involves more than just resetting a password.

How Can Someone Still Access Your Email After a Password Change?

When someone breaks into an email account, they may make changes that allow them to maintain access even after the password has been updated.

Here are five common ways this can happen.

1. They May Still Be Logged In

   When you sign in to your email, your browser or email app remembers that you’ve already logged in. This allows you to access your messages without entering your password every time.

   Unfortunately, an attacker who logged in before you changed your password may still have an active session.

   Depending on your email provider, changing your password may not automatically sign out every device or application.

   What to do: Your IT provider should revoke active sessions and sign the account out of all devices. If a computer may have been infected with malware, it should also be checked before being used again.

2. They Could Be Forwarding Your Emails to Themselves

   An attacker may set up an automatic forwarding rule that sends copies of your incoming emails to an outside address.

   They don’t necessarily need to forward everything, either. They could create rules that only forward emails containing words like “invoice,” “payment,” or “password reset.”

   They may also create rules that hide certain messages from your inbox, making suspicious activity harder to notice.

   What to do: Have your IT provider review all email forwarding settings, inbox rules, and filters, including any hidden rules.

3. They May Have Connected an Application to Your Account

   Many businesses connect their email to other tools, such as scheduling software, customer management systems, and document-sharing applications.

   These connections often allow an application to access certain account information without needing your password every time.

   Attackers can take advantage of this by getting someone to approve a malicious application that appears legitimate.

   Once connected, the application may continue to have access even after the email password changes.

   What to do: Review applications connected to the email account and remove anything unfamiliar or unauthorized. Your IT provider should also verify the permissions each application has been granted.

4. They Could Have Given Another Account Access to Your Mailbox

   Business email systems often allow employees to share access to mailboxes.

   For example, an administrative assistant may have permission to manage an executive’s inbox.

   An attacker could potentially grant similar permissions to another account, allowing them to read or send emails without signing in as the original user.

   Changing the mailbox owner’s password won’t necessarily remove that access.

   What to do: Review who has permission to access the mailbox or send messages on its behalf. Remove any permissions that aren’t recognized or approved.

5. They May Have Changed Your Account Recovery Settings

   An attacker could add their own phone number, recovery email address, authenticator app, or other sign-in method to your account.

   This could give them another way to access the account or regain access later, even after you’ve changed the password.

   What to do: Check all account recovery information and multifactor authentication (MFA) methods. Remove anything that doesn’t belong to the account owner.

What Should You Do If Your Business Email Is Compromised?

If you suspect someone has accessed your business email, it’s important to act quickly.

Your IT provider should help you take the following steps:

1. Secure the account. Temporarily disable access if necessary, change the password, and revoke active login sessions.
2. Check for unauthorized changes. Review forwarding rules, connected applications, mailbox permissions, and account recovery settings.
3. Investigate what happened. Look at login activity, security alerts, and email history to determine what the attacker may have accessed or changed.
4. Check for suspicious messages. Review sent and deleted emails, especially anything involving invoices, payment instructions, or password resets.
5. Notify anyone who may have been affected. If fraudulent emails were sent from your account, contact recipients through a trusted communication method. If payments may have been redirected, contact your bank immediately.
6. Make sure MFA is enabled. Multifactor authentication adds another layer of security by requiring additional verification when someone signs in.

It’s also important to remember that business email is often connected to other accounts, including accounting software, cloud storage, and other business applications. If an attacker accessed password-reset messages, those accounts may need to be reviewed as well.

How Can You Prevent This From Happening Again?

While no security measure can eliminate every threat, there are steps businesses can take to reduce the risk of an email compromise.

• Require MFA for all employees. This makes it harder for attackers to sign in with stolen passwords. Phishing-resistant methods, such as passkeys and security keys, offer even stronger protection.
• Limit automatic email forwarding. Block forwarding to outside addresses unless there’s a legitimate business reason for it.
• Control connected applications. Restrict which third-party applications employees can authorize to access company email.
• Train employees to recognize suspicious activity. Unexpected MFA requests, unfamiliar login notifications, and emails they didn’t send should all be reported immediately.
• Have a response plan. Make sure employees know who to contact if they suspect their email has been compromised.

Frequently Asked Questions

Does changing my email password log out everyone?

Not always. It depends on your email provider and how the account was accessed. Your IT administrator may need to separately revoke active sessions and sign out connected devices.

Can someone still receive my emails after I change my password?

Yes. If an attacker created an automatic forwarding rule, they may continue receiving copies of your emails until that rule is removed.

Can someone access my email without knowing my password?

Yes. Certain connected applications and mailbox permissions can allow access without requiring the account owner’s password.

Is multifactor authentication enough to protect my email?

MFA is an important security measure, but it isn’t a complete solution. It helps prevent unauthorized sign-ins, but it doesn’t automatically remove existing forwarding rules, connected applications, or other unauthorized access.

Should I delete an email account that’s been hacked?

Usually, no. Your IT provider may temporarily disable the account while investigating and securing it. Deleting the account could remove information needed to understand what happened.

The Bottom Line

Changing your password is an important first step, but it isn’t always the last step.

If someone has accessed your business email, you need to make sure they’ve been completely removed from the account, including any hidden ways they may have set up to maintain access.

At Box Lake Networks, we help Kentucky businesses protect their email systems, investigate suspicious activity, and strengthen their cybersecurity defenses.

Think your business email may have been compromised? Contact Box Lake Networks. We’re here to help.