What to Do When Your Email Account Is Compromised: A Complete Guide

Email compromise is one of the most common and damaging security incidents that businesses face today.

When a staff member's email account falls into the wrong hands, the consequences can be severe—from data breaches and financial fraud to reputational damage and loss of client trust.

At Kaizen IT, we've helped countless organisations respond to and recover from compromised email accounts. Through our experience, we've developed a helpful playbook that outlines exactly what to do when an email compromise occurs, helping you act quickly and effectively to minimise the damage.

A compromised email account gives attackers a trusted voice within your organisation. They can:

• Send convincing phishing emails to colleagues, clients, and partners
• Access sensitive business information and confidential communications
• Initiate fraudulent financial transactions
• Compromise additional accounts and systems
• Damage your organisation's reputation and client relationships

The average cost of an email compromise incident can run into tens of thousands of pounds, not to mention the time spent recovering and the potential legal implications under GDPR and other regulations.

When you suspect an email account has been compromised, every minute counts. The faster you can contain the incident, reset credentials, and communicate with affected parties, the less damage the attackers can do.  However, in the heat of the moment, it's easy to miss critical steps or take actions in the wrong order. That's why having a clear, documented playbook is essential.

Our playbook guides you through every stage of responding to an email compromise, including:

• Immediate containment steps  to stop the attacker's access

• Investigation procedures  to understand what happened and what data was accessed

• Communication protocols  for notifying staff, clients, and relevant authorities

• Recovery processes  to restore normal operations securely

• Preventative measures  to reduce the risk of future incidents

The playbook includes practical checklists and template communications to help you respond effectively even under pressure.

Whilst having a robust playbook is essential for responding to email compromise incidents, prevention and early detection are even better. This is where continuous monitoring becomes invaluable.

Kaizen IT's Blackpoint MDR (Managed Detection and Response) service provides round-the-clock monitoring of your systems through a dedicated Security Operations Centre (SOC). This means that suspicious activity—such as unusual login attempts, unexpected email forwarding rules, or abnormal data access—can be identified and addressed before a minor security event becomes a major incident.

Think of it as having a team of security experts watching over your IT infrastructure 24/7, ready to respond the moment something unusual happens. For many organisations, this level of proactive protection provides invaluable peace of mind and significantly reduces the risk of successful email compromise attacks.
If you'd like to learn more about how Blackpoint MDR could complement your existing security measures, our team would be happy to have a conversation about your specific requirements.

Email compromise can happen to any organisation, regardless of size or sector. Having a response plan in place before an incident occurs can mean the difference between a minor inconvenience and a major business crisis.

Download our free Compromised Email Playbook today and ensure your team is prepared to respond effectively when every second counts.
If you'd like to discuss how Kaizen IT can help strengthen your email security or support you with incident response, get in touch with our team on 0345 141 1400 or hello@kaizenit.co.uk