Emails getting hacked is a fixable problem — starting today.

Triage order for a compromised mailbox: change the password and revoke active sessions (a password change alone doesn't kick out an attacker already logged in); switch on multi-factor authentication immediately; check the mailbox rules — attackers plant forwarding and delete rules to watch you silently, and finding one is the confirmation; review sent items for what went out in your name; and warn anyone who received suspicious mail from you, fast, before an invoice gets paid to the wrong account. If money has moved, contact your bank's fraud line immediately — speed matters more than embarrassment. Then take a breath, because the next section is how this never happens again.

Almost every business email compromise walks through two open doors: no MFA, and permissive defaults. Closing them is neither hard nor expensive. Layered email security stops the phishing mail arriving (filtering, link protection, impersonation scoring for the fake-MD and fake-supplier emails), MFA makes stolen passwords useless, and enforced DMARC stops criminals sending mail that claims to be from your domain — protecting your customers from fraud committed in your name. We audit, configure and monitor the lot; most of what we fix is Microsoft 365 tenants left on factory settings. If email is how your business transacts, this is the least optional security you can buy.