My Email Account Was Hacked — What to Do Right Now

There's an important distinction worth making up front: an email address showing up in a data breach means your address was exposed as a piece of data — it doesn't mean anyone has access to your inbox. A hacked email account is different and more urgent: someone else can actually log in, read your messages, and use the account as if it were theirs. If that's what's happening — password reset emails you didn't request, sent messages you don't recognize, contacts telling you they got strange emails from you — the priority order below is what actually matters, in order.

Step 1: Try to regain access immediately

If you can still log in, do these three things in the same sitting, before anything else:

• Change your password to something you haven't used anywhere else, and enable two-factor authentication if it isn't already on.
• Check "recent activity" or "sign-in history" in your account security settings — most major providers show device and location logs, which tells you if the intruder still has an active session.
• Sign out of all other sessions/devices — this is usually a single button in security settings, and it immediately kicks out anyone else logged in.

If you can't log in because the password's already been changed, use your provider's account recovery flow immediately — the longer this waits, the more time an intruder has to change recovery details and lock you out permanently.

Step 2: Check what they could have accessed

Once you're back in, don't assume the damage is limited to the inbox itself. Review:

• Forwarding rules — attackers often set up silent auto-forwarding to keep reading your mail even after you've regained access. Check and remove any forwarding rule you didn't set up yourself.
• Recovery email and phone number — confirm these still point to details you control, not something the intruder added.
• Connected apps and third-party access — check your account's "connected apps" or "security" page for anything unfamiliar with access to your account.
• Sent folder and drafts — for signs of what was actually done with the access, including messages sent to your contacts.

Step 3: Secure everything the email touches

Your email is usually the recovery method for most of your other accounts — which means a compromised inbox is a skeleton key, not a single lock. Prioritize:

• Banking and financial apps — change passwords and check recent transactions.
• Any account where "forgot password" would send a reset link to this email.
• Social media accounts linked to this email for login or recovery.

Change these passwords to something unique per account, not the same new password reused everywhere — that just recreates the original vulnerability under a different name.

Step 4: Report it, if warranted

Unauthorized access to an email account is a cognizable offence in India, and if the intruder used your account to send messages to your contacts, attempted financial fraud, or if you suspect the access ties into a broader identity theft attempt, it's worth filing a complaint through India's National Cybercrime Reporting Portal. Keep screenshots of the suspicious sign-in activity and any messages sent without your knowledge as supporting evidence.

Step 5: Figure out how they got in

Understanding the entry point matters for preventing a repeat. The most common causes, roughly in order of likelihood:

• Password reuse — the same password used on another service that was separately breached.
• Phishing — a fake login page that captured your credentials directly.
• No two-factor authentication — a password alone was sufficient, with nothing else standing in the way.

If you're not sure which applies, checking whether your email has appeared in a known breach is a reasonable starting point — it won't confirm the exact cause, but it narrows the possibilities.

Once your account is secure, it's worth checking the wider picture too — a hacked email is often one symptom of broader identity exposure, not an isolated event. Scan My Shadow checks your email and phone number across 1,500+ sources so you can see what else might need attention.

Related Reading

• How to Check If Your Email Has Been Leaked — the passive-exposure version of this problem.
• What Should I Do If My Email Appears in a Data Breach? — the breach-specific response plan.
• Credential Stuffing Explained — how password reuse enables exactly this kind of takeover.
• How to File a Cybercrime Complaint in India — the filing process if you decide to report it.
• Recovering a Hacked WhatsApp or Social Account — the same playbook applied to other platforms.