The first sign is rarely dramatic. A vendor replies to a thread you never started, asking whether the new bank details are correct. A board member mentions an odd message from the office address at two in the morning. The sent folder holds a note nobody wrote, or the login alerts list a city nobody has been to. Each one, on its own, could be explained away. Together they mean one thing: someone else is reading the mailbox, and has been for a while.
This is the sober Tuesday of Security Month, and it earns that register. Email is the skeleton key of the whole stack. Whoever holds a mailbox can reset the password on nearly everything attached to it, which is why a mailbox intruder is a different emergency from the phished password in "Someone Clicked the Link." That post was a race against the first login. This one assumes the intruder is already inside, has furnished the place, and reads what you read. The sequence below evicts them first, then hunts the housekeeping intruders leave behind, then checks what the key has already opened.
The one rule before you start
Work from a clean device, and do not tip them off from inside the account. The instinct is to open the mailbox and start looking around, delete the forwarding rule, and reply to the vendor to explain. Every one of those moves is visible to someone who has configured that mailbox to report to them, and some intruders respond to being noticed by moving faster. Contain first; investigate second.
Step 1: Evict (the first fifteen minutes)
From a device you trust, change the password to a vault-generated one. Then use the provider's security page to sign out everywhere, which ends every active session, including the intruder's. Turn on two-factor authentication (2FA), and if it was already on, re-enroll it fresh and treat the old second factor as possibly compromised. Then check the recovery email and phone number on the account. Intruders change these so they can come back in after you change the locks. Write down the time you evicted them and the first sign you noticed, because those two timestamps start the incident log.
Step 2: Hunt the housekeeping
Intruders furnish mailboxes for a long stay, and each item below is a known move. Open the settings and look for forwarding rules and filters: anything that sends, copies, or deletes mail. The classic pair is a rule forwarding every message containing "invoice" or "password" to an outside address, and a second rule deleting the evidence. Check delegates and connected apps, and revoke anything unfamiliar. Check app passwords for ones nobody created. Confirm the signature and the reply-to address are unchanged; a reply-to pointed at a lookalike domain is how a redirected payment keeps going after you think you have fixed it.
Then read the sent folder and the trash. What did they send, to whom, and when? Take screenshots as you go. This is the damage map, and every step that follows depends on it.
Step 3: Follow the key
Everything that can be reset from this mailbox is now suspect. The inventory from Chapter 2 answers in minutes which accounts use this address for login or recovery; memory answers slowly and incompletely. Rotate the critical ones in order: hosting, registrar, DNS, anything near money, then the social accounts. For each, look for signs the key was already used: a password-changed notice, a new session, a changed setting, an added administrator. Anything found routes to its own playbook, and the site, the domain, and the socials each have one.
Step 4: Handle what the intruder did
The damage map tells you who received mail from the intruder. Warn each of them individually and plainly, because their trust in this address was the target. Where a message changed an invoice or redirected payment instructions, call those recipients by phone, now, not by email from the account that was just compromised. Payment redirection is the usual point of the whole intrusion, and a vendor who has already paid the wrong account number needs to hear from a voice they recognize. Then complete the provider's compromise-reporting flow; the large providers can restore deleted mail and flag the incident internally.
Step 5: The disclosure question
Read the damage map honestly. Could the intruder have read personal data: customer records, donor information, health or payment details? If the answer is plausibly yes, disclosure duties may apply, and that determination belongs with a professional, decided on the Step 2 evidence rather than on optimism. Chapter 17 of the book covers when to call one. Write down who you consulted and when.
Step 6: Close the loop
Write the incident log entry: the entry vector if you can find it (a phish, a reused password, no 2FA), the dwell time between first entry and eviction, and the actions taken. Then close that entry vector for every mailbox in the organization, not just this one. Unique passwords, 2FA with its seeds in organizational custody, and the never-log-in-through-a-link habit go to every colleague before the week ends. Finally, add a five-minute spot-check of forwarding rules and delegates to the quarterly maintenance calendar. Today's Step 2, four times a year, is how you find the next one in days instead of months.
What this one teaches
Chapter 10 of the book builds email as the quiet system that carries everything else, which is exactly why it is the intruder's favorite room. The standing defenses are the ones Security Month has been assembling since early October, and 2FA is the one that matters most here: an intruder with a password and no second factor stays outside. This mailbox now has the full set. Give its siblings the same.
Get the triage page before you need it. When more than one thing is wrong, or something is wrong and you cannot yet name it, the Web Emergency Playbook's "Everything Is On Fire" page tells you which fire to work first and what the first move is. Print it, and keep it somewhere a shaken person can find it without logging in.