What is the best way to cut the damage from a compromised email account?

Why session revocation matters before anything else

The fastest way to reduce damage is to assume the attacker may already have an active foothold in the mailbox. Revoking sessions ends that foothold, and resetting the password only matters if it is paired with token invalidation, because many email platforms keep access alive through existing browser sessions, refresh tokens, or app passwords.

For a practical response pattern, use the Account Takeover Response Playbook as a containment model: terminate active access first, then remove the credentials and tokens that can silently re-establish it.

When an account is already compromised, treating password reset as the only fix leaves a common gap, especially if the attacker has cached tokens, mobile mail clients, or legacy application access. The goal is to force every trusted session and authorisation grant to be re-established deliberately.

How to remove persistence from a hijacked mailbox

Once immediate access is cut off, the next priority is to remove the paths that let the attacker continue receiving mail or impersonating the user. Forwarding rules, inbox rules, delegated access, connected apps, and recovery settings can all create persistence even after the password changes.

The reason this step matters is simple: a compromised email account is often used as a control plane for other accounts, so hidden forwarding or delegation can keep exposing password resets, invoices, approvals, and internal messages after the initial compromise seems resolved. The Hacked Social Media or Email Account Recovery Guide is useful here because it focuses on session sign-out, forwarding rules, recovery details, and other post-hack checks.

Also review recent sign-ins and connected devices to spot whether the compromise is localised or part of a broader account takeover pattern. If the mailbox is tied to a business environment, review whether any delegated access or shared mailbox permissions were abused to reach other users or shared resources.

What to check after containment and before restoring trust

Containment should be followed by a short but disciplined validation sweep. Check whether messages were sent, deleted, or used to alter payment details; whether recovery email or phone settings were changed; and whether the account was used to approve MFA prompts, add new forwarding destinations, or create rules that hide security alerts.

A broader identity incident lens is helpful because email compromise is rarely isolated. The Identity Incident Response Playbook covers the triage and recovery flow that applies when a mailbox is part of a wider account compromise, including credential revocation and evidence-led recovery.

For organisations, preserve the relevant audit trail before it rolls off retention. Mailbox audit logs, sign-in logs, rule changes, forwarding changes, and admin actions are often the difference between a clean recovery and a second compromise through an overlooked persistence path.

Risk and Threat Considerations

A compromised email account is high value because it can be used to reset passwords, intercept approvals, and impersonate the victim across other services. The biggest failure mode is partial recovery: the user gets back into the mailbox, but the attacker still has a session, token, forwarding rule, or delegated path that keeps the compromise alive.

Failure mechanism: Existing sessions, refresh tokens, app passwords, forwarding rules, and mailbox delegation can survive a password reset and preserve attacker access or visibility.

Impact: The attacker can continue reading mail, resetting other accounts, siphoning sensitive messages, or using trusted sender status for fraud and phishing.

Practitioner Guidance

What to prioritise: Treat active session revocation and token invalidation as the containment step, not the postscript. If you cannot confirm that old access paths are dead, you have not finished the response.

What to verify: Confirm that forwarding, inbox rules, delegated access, recovery settings, and connected apps are clean before you declare the mailbox restored. The same person should not be both the account owner and the sole verifier for high-impact mailboxes.

Decision rule: If the mailbox can reset passwords for other systems, escalate the incident severity and check adjacent accounts immediately. If it cannot, focus on message integrity, fraud prevention, and evidence preservation, but still remove all persistence before returning normal access.

Practitioner takeaway: The key judgement is to separate restoration from trust, because a mailbox is only safe again once every live session, token, rule, and delegation path has been removed and revalidated.

Related resources from NHI Mgmt Group

• Guide: MITRE ATT&CK T1586 Compromise Accounts Guide
• How should organisations limit damage when a messaging account is compromised?
• How should financial institutions contain a breach when an employee email account is compromised and sensitive customer data may have been exposed?
• What are the signs that an email account has been compromised and is being used for lateral movement?
• What happens when attackers use a compromised email account to move through connected SaaS apps?