When an employee work email appears in a data breach alert, it is natural to worry that someone has taken over the account. But an exposed email address alone does not prove that the mailbox was accessed. The information listed in the alert matters: an address, a password, or other account details call for different responses.
Start by checking what was exposed, then secure the employee’s identity and look for signs of account access. At the same time, alert the people who handle payments so they can watch for unusual requests.
First, find out what the alert actually exposed
Review the alert’s details and source. Identify whether it shows only the employee’s email address, or whether it includes a password, other credentials, or additional personal information. If the alert is vague, ask the provider that sent it what data it detected and when it was found.
An exposed address can make an employee a target for convincing phishing messages, but it does not by itself show that anyone signed in. If a password was exposed, treat it as compromised, especially if the employee reused it elsewhere. Don’t ask the employee to send passwords by email or chat.
Keep a record of the alert and when the business received it. That gives the person investigating a starting point and helps the business track what it has done.
Secure the affected identity
If a password was exposed, or the employee reused that password for their work account, have them change it through the organization’s trusted sign-in page. Use a new, unique password. If your business has an administrator or IT provider, coordinate the change with them so it is completed safely.
Confirm that multifactor authentication is enabled and that the employee’s recovery details and MFA methods are still theirs. CISA explains why businesses should require multifactor authentication. If you suspect the account was accessed, have an administrator revoke active sessions and check for unfamiliar connected applications or access permissions. A password change alone may not end every existing session.
Also reset any other business account where the same password was used. Prioritize accounts that can open other systems or expose sensitive information, such as single sign-on, payroll, cloud file storage, banking, and vendor portals. Change each password to a distinct one rather than making small variations of the same password.
Check whether the mailbox was accessed
Ask an administrator to review available sign-in and mailbox activity. Look for unfamiliar successful sign-ins, devices, locations, MFA changes, or recovery details. Unusual activity is a reason to investigate; the alert alone is not proof of access.
Check the mailbox itself for changes that could hide messages or keep copies flowing to someone else. Review:
- Forwarding to an unfamiliar address
- Inbox rules that move, delete, or mark messages as read
- Unexpected sent or deleted messages
- Unfamiliar delegates or connected apps with mailbox access
- Changes to recovery information or MFA methods
If the employee can access shared drives or other cloud files, check for unexpected access or sharing changes there, too. Microsoft’s guidance on responding to a compromised email account in Microsoft 365 covers account investigation and mailbox checks. If your business uses a different email platform, consult its administrator guidance or your IT provider.
When you find suspicious activity, preserve relevant records and involve the administrator or security provider before removing settings or messages. They can help contain access while keeping useful investigation details.
Give finance a clear warning
Email access can create opportunities for payment fraud. An attacker may impersonate an employee, reply within an existing conversation, or send a request that appears to come from a vendor. The FBI’s IC3 recorded 24,768 Business Email Compromise complaints and $3,046,598,558 in reported BEC losses in 2025. These are reported complaints and losses, not a count of every incident. The 2025 IC3 Annual Report provides that context.
Tell finance staff and payment approvers about the alert, especially if the employee handles invoices, payroll, or vendor communications. Ask them to treat unexpected payment requests and changes to payment instructions cautiously. Verify a change using a phone number or contact method already on file, not the details in the message requesting the change. A second review before payment can add another check.
If money has already been sent in response to a suspicious message, contact the bank or payment provider’s fraud team promptly. Notify your internal decision-maker and IT or security provider, and preserve the related emails and transaction details. Quick action may give the financial institution more opportunity to respond.
Make the response easier to repeat
Write down who will check sign-ins, mailbox settings, connected services, and payment activity when an alert arrives. A clear process helps avoid relying on one person’s memory during a stressful event. A practical incident response plan for a small business can set out those responsibilities and escalation steps.
It also helps to teach employees how to report suspicious messages and unexpected sign-in prompts. Clear reporting makes it easier to investigate without blame, and supports broader employee cybersecurity training.
Frequently asked questions
Does an exposed work email mean the mailbox was hacked?
No. An exposed email address alone is not evidence of mailbox access. Check whether the alert includes a password or other credentials, and review sign-in and mailbox activity for signs of access.
Should we reset the employee’s email password?
Reset it if the password was exposed, reused, or there are signs the account was accessed. Use a unique password and confirm MFA and recovery details. If the alert lists only an email address, investigate before assuming the mailbox was compromised.
How can we tell whether someone accessed the mailbox?
Review sign-in activity, active sessions, recovery details, MFA methods, connected apps, forwarding, inbox rules, and sent and deleted items. Ask an administrator or provider for help interpreting anything unfamiliar.
What if the employee reused the exposed password?
Change it anywhere it was reused, starting with accounts that can access sensitive business information, payments, or other systems. Give each account a distinct password.
Who should we contact if money was sent?
Contact the bank or payment provider’s fraud team promptly. Also alert your internal decision-maker and IT or security provider, and keep the messages and transaction details available for review.
Secure the account, then follow the evidence
An exposed work email is a reason to act, but not a reason to assume the mailbox was taken over. Confirm what information was exposed, secure any affected credentials, investigate related access, and make sure finance knows to verify unusual payment requests independently.
Zevonix provides fully managed cybersecurity purpose-built for companies with 5 to 200 employees, with 24/7 threat monitoring included with every plan. If your business needs help reviewing an alert or planning its response, call (904) 658-0777.