Look for changes you did not make.
Unexpected password resets, unfamiliar devices, new forwarding rules, or messages sent from your account can be signs of unauthorized activity. An unfamiliar sign in location is a reason to investigate, although location information alone does not prove a breach.
Use a trusted route to the account.
Open the service directly through a known address or your company’s approved app. Do not use links in a suspicious alert. For a work account, contact IT before making changes that could interfere with an investigation.
Review more than the password.
Your administrator may need to review active sessions, sign in records, authentication methods, mailbox rules, connected applications, and other account changes. Resetting a password is not always the whole response.
Build better account defenses.
- Use unique passwords stored in a reputable password manager.
- Enable multi factor authentication and use stronger methods where supported.
- Never approve an authentication request you did not initiate.
- Remove access that is no longer needed.
- Make it easy for employees to report suspicious activity.
ECC’s cybersecurity consulting can help you prioritize account security improvements.