(Changing your password only secures the front door.)
Changing your password is an important step after an account hack, but it likely will not remove an attacker's access. After a hack, it's important to check active sessions, security settings, connected applications, etc.
Once the employee can sign in again (and suspicious messages stop), the individual might assume the account is secure. When an employee reports a hacked email account, resetting the password can feel like a clear resolution. Hackers are experts about waiting to take action.
Think of a passowrd reset as securing the front door after a break-in. Before you lock the door and assume the intruder is gone, someone needs to check if the intruder is still inside or has arranged another way to re-enter the building later.
A password helps control new sign-ins, but an account can have existing sessions. Your account can also have previously approved permissions that allow hackers to stay in your account. Because those forms of access work differently, a password reset does not always end them all.
After you sign in, an application usually remembers that you have approved the sign-in. Session cookies and tokens support this convenience, allowing you to open messages without repeatedly entering your password.
A stolen session cookie can let an attacker use an account as if they were already signed-in, without a hacker needing to enter the password again. Microsoft describes this in its report on phishing attacks that steal sign-in sessions.
Some password resets end active sessions, but others do not. Your IT team should throughly check each service to make sure the attacker is out of your account. Microsoft explains why this can require separate steps in its guidance on removing account access.
During an account takeover, an attacker may change multifactor authentication (MFA) settings to create another way into your account. For example, they could add their own phone number to receive sign-in codes. If that number stays on the account, the attacker may have access after a password reset. Microsoft documents this tactic in its investigation of phishing and email fraud.
Your IT team should check that the account's sign-in methods belong to the employee. The FTC also recommends checking recovery email addresses and phone numbers to make sure they are correct.
Some attacks persuade an employee to approve an application that requests access to email or documents. The employee may believe they are connecting a useful business tool while granting access to an unauthorized app.
Changing a password or turning on MFA does not automatically remove an app's access. Your IT team needs to check which apps can reach company information and remove any that should not have access. Microsoft explains this in its guidance on unauthorized app permissions.
An attacker may create forwarding settings or inbox rules that send messages elsewhere or hide certain replies. These rules can keep working after a password change, so your IT team should check them during recovery. Microsoft includes this review in its steps for recovering a compromised email account.
Missing messages and unfamiliar rules are among the warning signs covered in our guide to recognizing business email compromise.
If you suspect an account compromise, contact your IT or cybersecurity provider using a known phone number. Describe what happened, including whether the employee entered credentials, downloaded a file, or approved an unexpected sign-in request.
Your provider should check how the attacker got in, remove their access, and review what they did. The steps below explain what that work can include.
Your response team may temporarily disable the account while investigating. It should reset the password using a trusted device and sign out active sessions. Some connected apps may need separate attention. Microsoft includes these actions in its compromised-account recovery guidance.
If the employee reused the stolen password elsewhere, those accounts need unique replacements as well. Do not send the replacement password through the affected mailbox.
Ask your provider to check the account's MFA settings, connected app permissions, and mailbox rules. The team should save records of suspicious changes before removing them so it can investigate what happened.
These checks help confirm that the employee controls the account and that no known way back in remains for the attacker.
A password reset does not remove malicious software from a computer. The FTC recommends updating security software and scanning for suspicious software. Coordinate this work with your IT team.
Ask your response team what the attacker did, including whether they signed in, sent messages, or changed account settings. The team should explain what the records show and what remains unknown.
If someone copied a confidential document, changing the password cannot retrieve that copy. Similarly, an attacker who studied an invoice conversation may use its details to impersonate a supplier from another address.
Before changing payment details, call the vendor (using a phone number you already trust) and follow your normal process. Your response team should identify anyone who needs a warning about scam messages or exposed information.
Consider a hypothetical manufacturer in Cincinnati, Ohio whose purchasing coordinator receives a convincing supplier message. After following a link, the coordinator enters their credentials on a fraudulent sign-in page.
Before anyone notices, the attacker reads an invoice conversation and creates a rule that hides replies from that supplier. The business resets the password after the employee reports suspicious activity, but no one checks the mailbox rules.
Even if the reset ends the attacker's access, the hidden replies can still disrupt communication. If the attacker copied the conversation, its details could lead to a payment scam.
The manufacturer needs to fix the mailbox rules and check whether any invoices or payments were affected. Being able to sign in with the new password does not show that this work is complete.
Ask your provider how they find suspicious sign-ins and account changes. Our guide to email security for businesses explains addotonal safeguards to discuss with your team.
Employees need a clear reporting process of issues and need practice verifying unusual requests. Include examples that resemble everyday work, such as a document-sharing notice or supplier payment change. Our article on AI phishing emails and what your team should check can support that training.
For a CPA firm, preparation may focus on client documents and financial correspondence. A nonprofit may prioritize donor communications and payment approvals. Your response plan should reflect what employees can access through their accounts.
Some services keep users signed in after a password change. Your IT team should check active sessions and sign out unauthorized users, including any possible sessions with connected apps.
Yes, some attacks steal a session after a user has signed in to your account. This allows the attacker to access the account without entering the password or an MFA code again. MFA still offers a strong layer of defense. Microsoft describes this risk in its report on stolen sign-in sessions.
Ask your IT provider how it removed the attacker's access and which account changes it corrected. They should also explain how they will watch for further suspicious activity. A successful sign-in with a new password does not prove the attacker is out of your account.
4BIS has served Greater Cincinnati and Northern Kentucky businesses since 1996. Our Cincinnati cybersecurity services include risk assessments, employee training, and managed security to help organizations understand and address their risks.
If your recovery process stops at a password reset, contact the 4BIS team for help reviewing your next steps. We can discuss how to check for remaining access and investigate what happened while the attacker was inside.