Secordit Intelligence

Business email hacked? What to do in the first hour (UK)

23 October 2026 · Matthew Protheroe-Hill

Secordit Intelligence logo on a dark background beside an overhead photo of hands typing on a laptop, a phone on the desk

Last checked: 25 October 2026

Short answer: If your business email has been hacked, use your provider's official recovery route first. Then check for forwarding rules you didn't set, change the password (and any reused ones), sign out other devices and turn on 2-step verification. If you've lost money, tell your bank straight away and report it to Report Fraud.

Perhaps a customer has asked why you sent them an invoice with new bank details. Perhaps you've had a password-reset email you didn't ask for. Either way, the order you do things in matters. This guide takes a sole trader or small business through the first hour. It covers the mailbox itself, then the customers and suppliers who might be on the receiving end.

How do I know my business email has been hacked?

The NCSC lists the signs to look out for:

  • you can't log in to your account
  • changes to your security settings
  • messages or notifications sent from your account that you don't recognise
  • logins or attempted logins from strange locations or at unusual times
  • money transfers or purchases you didn't make

You might hear about the third one from a customer before you spot it yourself.

What should I do first if my email is hacked?

Work through these in order. They follow the NCSC's own steps for a hacked account.

  1. Use your provider's official recovery route. Go to your email provider's own help or support pages. The recovery process is likely to be different for each provider.
  2. Check your filters and forwarding rules. The NCSC says "a common tactic used by cyber criminals is to set up a forwarding rule", so they get a copy of every email sent to you, "which would allow them to reset your passwords". Delete any rule or filter you didn't set up.
  3. Change the password. Change it on the hacked account and on any other account that uses the same password. Criminals "will try the same 'hacked' password across multiple accounts".
  4. Sign out of all devices and apps. This is usually in the Settings, Privacy or Account options. Anyone still signed in will then be asked for the new password.
  5. Turn on 2-step verification (2SV). The NCSC says that with 2SV on, even a criminal who knows your password won't be able to get into your account. Codes sent by text message can be intercepted after a SIM swap.
  6. Update your devices and apps. The NCSC calls this "one of the most important (and quickest) things you can do to prevent your account from being hacked".
  7. Tell your contacts. Let them know you were hacked and ask them to treat recent messages from your account with suspicion.
  8. Check your bank and shopping accounts for anything you didn't do. Contact your bank through its official website or phone number, not through links in any message you've been sent.
  9. Report it. See the reporting section below.

Does someone else run your email for you, such as an IT person who looks after your Microsoft 365 or Google Workspace account? Tell them as soon as you can. The NCSC's guidance on business payment fraud puts it this way: "the sooner they know, the sooner they can help".

To have a written plan ready for next time, see First Hour After a Breach, our incident response plan template.

What if someone used my email to send fake invoices or change bank details?

This is the business side of a hacked mailbox. The NCSC describes criminals pretending to be someone you deal with regularly. They send an invoice that looks real but contains a virus, or ask you to pay money into a different bank account. It calls this business payment fraud, "also known as Business Email Compromise (or BEC)".

If you've paid money you shouldn't have, contact your bank directly using its official website or phone number.

Then warn your customers and suppliers. Ask them not to act on any recent email from your address that asks for a payment or changes bank details. If in doubt, they should ring you on a number they already have.

Should I report a hacked business email, and to whom?

  • If you've lost money, tell your bank and report it to Report Fraud (which replaced Action Fraud), the UK's reporting centre for cyber crime.
  • Report Fraud covers England, Wales and Northern Ireland. You can report online at reportfraud.police.uk or call 0300 123 2040. Its site tells any business "under a cyber attack" to call that number immediately.
  • In Scotland, contact Police Scotland on 101.
  • Scam emails you've received can be forwarded to [email protected].
  • Scam texts can be forwarded to 7726, which is free.

Do I need to tell the ICO if my business email is hacked?

It depends on whether personal data was involved and how much risk there is to people. Your mailbox may well hold customers' personal details. The NCSC points out that business emails "qualify as data, so you must protect your account as part of your GDPR obligations".

The ICO's guidance says: "When you've had a personal data breach, you must assess the likely risk to people's rights and freedoms. If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours." If the risk to people is high, "you must also notify those people without undue delay".

The ICO has a self-assessment tool and "a simple guide about how to respond to a breach in the first 72 hours to help small companies and sole traders". Start with those on the ICO's breach reporting page. The ICO notes its guidance is under review following the Data (Use and Access) Act. This is general information, not legal advice.

How do I stop my business email being hacked again?

  • Use a passkey if your provider offers one. The NCSC says passkeys "can't be intercepted, reused or stolen like passwords", and "where your email provider supports passkeys, you should enable them for staff accounts as a priority".
  • Otherwise, a strong, unique password plus 2SV. Even with a passkey, any password still on the account should be strong, unique and backed by 2SV. The NCSC's view is that "any type of 2SV is better than none".
  • Use a password manager. The NCSC recommends saving your passwords to your device or browser, or using a password manager.
  • Change access when people leave. When someone joins, changes role or leaves, their access should change too. Our Joiners, Movers and Leavers Access Checklist has a checklist for each.
  • Check your forwarding rules and recovery details again every so often, not only after a scare.

To work through the rest of the basics one topic at a time, use our Small Business Cyber Starter Checklist.

Printable checklist: hacked business email, first hour

Suggested timings. The order follows the NCSC's steps.

Time Do this
0–5 min Now, if money has moved: call your bank, and report it to Report Fraud on 0300 123 2040 (Scotland: 101) as soon as you can. Then start your provider's official account recovery
5–10 min Delete any forwarding rules or filters you didn't set up
10–15 min Change the password, and any other account that used it
15–20 min Sign out all devices and apps; turn on 2SV or a passkey
20–30 min Warn contacts, customers and suppliers to ignore recent payment requests from your address
30–45 min Check your bank and shopping accounts
45–60 min Decide whether the ICO needs to know

Want this printed and ready before anything happens? Our Account Lockdown Kit, a paid guide we sell, includes a "Hacked? The first 30 minutes" card, the forwarding-rule check and a message template for warning friends, family or followers, all in plain English for UK owners. Get the Account Lockdown Kit

FAQ

Can I get my hacked business email back?

Usually, through your provider's official recovery route. If that fails, the NCSC says you'll need to create a new account. Then give your contacts the new details and update your bank, utility and shopping accounts.

Should I report a hacked email to Report Fraud?

If you've lost money, yes. The NCSC says to tell your bank. Report it to Report Fraud on 0300 123 2040 (in Scotland, call 101).

Do I have to tell the ICO?

Only if personal data was involved and the breach is likely to put people's rights and freedoms at risk. Then the ICO says to tell it "as soon as possible, and where feasible within 72 hours".

Why check forwarding rules?

The NCSC says a common trick is a rule that sends criminals a copy of every email you receive. That includes password resets.

What is business email compromise?

The NCSC describes criminals pretending to be someone you deal with, then sending fake invoices or asking you to pay a different bank account. It's also called business payment fraud.