Email account hacked

If your contacts receive strange messages from your address, you find unknown emails in your «Sent Items» folder or suddenly get lots of bounce messages, someone else very likely has your password. Follow these steps in this order, ideally right away.

1. Change your password immediately

This is the most important step, because only then is the attacker locked out.

• In OfficeMail: «Email settings» at the bottom left, then your address under «Accounts» and «Change password» (see OfficeMail account settings).
• Or in the hosting control panel (Plesk): choose your domain, «Mail», then «Mail Accounts», click the address and set a new password. This also works if you no longer know the old password.

Choose a long password that you do not use anywhere else. If you also used the old password for other services, for example an online shop or social media, change it there as well.

If our monitoring has already detected spam being sent from your mailbox, the password was automatically replaced with a random one and you received a ticket from us about it. Incoming mail keeps arriving. In this case simply set a new password as described above, there is no need to get back to us.

2. Check your devices

• Run a full virus scan on every computer you use with this mailbox and install pending updates for the operating system, browser and email program.
• Only then enter the new password in Outlook, Thunderbird, on your phone and on your tablet. Otherwise a device with malware would give away the new password right away.
• Think back: did you recently click a link in an email and enter your password there? Fake sign-in pages like these are the most common cause. We never ask for your password by email.

3. Check forwarding and out-of-office replies

Attackers like to quietly set up forwarding to read your mail, or switch on an automatic reply with a scam text.

• Forwarding: in OfficeMail under «Email settings», «Accounts», your address, section «Forwarding». If you see an address you do not know, remove it.
• Out-of-office reply: in the Mail app, open the account menu «…» of your address, then «Account settings» and «Autoresponder». If a reply is switched on that you did not set up, turn it off.
• Also check your filter rules and look in the «Sent Items» and «Deleted Items» folders to see what was sent in your name.

You will also find forwarding and the automatic reply in the hosting control panel under «Mail Accounts» for your address.

4. Warn your contacts

If emails were sent in your name, inform your most important contacts. Ask them not to open attachments or links from these messages and not to make payments to new bank details without calling you first.

5. Open a ticket

If you are stuck, if the mailbox keeps sending mail despite the new password or if you suspect other mailboxes are affected too, open a ticket. Include the affected address and since when you noticed something. Never send us your password.