A hacked Outlook mailbox can be used to reset other accounts, read private messages, hide replies and send convincing scams to contacts.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed September 2026.
Check mailbox rules and forwarding before assuming a password reset has fixed it. Attackers often hide messages or keep a route back in.
If you've been hacked, start with our step-by-step recovery checklist. It explains what to secure first, how to protect your email and accounts, what evidence to keep, and what to do next.
Recovery checklistIf this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
Keep the order simple: contain the issue, recover control, then strengthen the account or device so the attacker cannot return.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
For business email compromise, pause supplier bank-detail changes and tell staff which safe channel to use until email can be trusted again. Spam that only appears to be from you may be spoofing, but hidden rules or successful sign-ins should be treated as compromise.
If money, customer data, Microsoft 365, business email or a website is involved, get advice before wiping evidence or assuming the issue is closed.
These links help confirm the official recovery route. Use them alongside the checklist, especially when account recovery, fraud reporting or business data may be involved.
It may be a compromised mailbox, stolen password, rogue app permission or malware on a device.
Yes. Rules can hide replies, forward invoices or delete security alerts.
If scam messages were sent from your account, warn contacts using a safe route.
Tell us what happened, what is affected and whether money, customer data or business systems may be at risk.