My email has been hacked!

Last updated: 2 March 2022

When your email account is compromised the attacker typically starts sending thousands of spam and/or phishing emails. You will quickly notice there is an issue, as many of these emails will bounce to your inbox. By that time we will also have noticed the issue, as we actively monitor our servers for unusual SMTP activity.

How do email accounts get hacked?

From a security standpoint, email isn’t great. Anyone can try to send emails from an email address, and such attacks happen all the time. The attacker only needs to guess the password. And, there are still many people who (re)use weak passwords.

The firewall on our servers stops most of the attacks. Unfortunately, it is not possible to completely prevent email accounts from being hacked. It all comes down to password hygiene. In particular, if you use a single password for your email and various websites you are registered with then your email account is bound to be hacked. If one of the websites you are registered with gets compromised then the attacker has both your email address and password. They can do with your email account what they want.

In general, if you use a unique, random, complex and long password then your email account is safe. However, if you use a simple password then your account is vulnerable. And, if you are reusing a weak password then it is just a matter of time before your email account is compromised.

Targeted attacks

Not all email hacks aim to use your email account to send spam. It may be that you suspect someone is secretly accessing your emails. If you think that is happening, reset your email password and feel free to contact us.

Sextortion emails

You have probably received quite a few emails from criminals who claim to have hacked your email account. These emails usually claim that the attacker has accessed your web cam while you were viewing porn, and they demand you quickly pay ransom money. To “prove” that you have been hacked the email appears to come from your own email address. Often the email also includes a password you have used in the past.

Such emails are so-called sextortion scams. The attacker got your email address (and any password shown in the email) from a compromised website you were registered with and spoofed your email address. If you know how to view an email’s headers then you will see that the email was actually sent from another email account. You can safely delete sextortion emails. Or, if you want to be sure, feel free to submit a support ticket. If you can add the email as an attachment then we can check the email’s headers. It will almost certainly show that the email was not sent from your email address.

As an aside, the large amount of sextortion emails that are doing the rounds demonstrate how important it is to use unique and strong passwords. If you get a sextortion email that shows a password you use for various websites then please make sure you reset the password. And please, choose a strong and unique passwords for the websites!