Who to call if your company email is hacked in Ontario

Write down the time of each step. These work for Microsoft 365, Google Workspace and most hosted email.

1. 01

   Lock the attacker out

   Block sign-in or reset the password, then sign the account out of all sessions. A password reset on its own may leave an existing session active.

2. 02

   Check MFA and recovery settings

   Remove any MFA method, recovery phone or recovery email the user does not recognize.

3. 03

   Record, then disable, rules and forwarding

   Screenshot inbox rules, forwarding addresses and delegates before turning them off. They are evidence.

4. 04

   Do not delete anything

   Keep the mailbox, the suspicious messages and the user account. Deleting them destroys evidence your bank, insurer and lawyer will need.

5. 05

   Warn finance and anyone expecting a payment

   Tell them to confirm any banking change by phone, using a number already on file, not one from an email.

Not every fake email from your domain means an account was hacked. If your domain does not enforce DMARC, anyone can send mail that appears to come from it. In our Q4 2026 GTA email security study, only 20.7% of 482 mail-enabled GTA business domains enforced DMARC in October 2026. The steps differ, so it is worth knowing which you are dealing with.

• Check your domain with our email spoofing check
• If clients are getting fake invoices, see clients receiving fake invoices from you

Possibly. Mailboxes hold client and employee personal information. Under PIPEDA, an organization must report to the Office of the Privacy Commissioner of Canada a breach of security safeguards that creates a real risk of significant harm, notify affected individuals, and keep a record of every breach. Whether a hacked mailbox meets that test depends on what the attacker could reach, which is a question the forensic logs answer. Client contracts and your insurance policy may add their own notice requirements.

Full list of regulators and notice triggers: who to tell after a cyber incident in Canada.

A password reset ends the access but answers none of the questions that come next: how did they get in, how long were they there, what did they read, who did they email, and is another account affected? A business email compromise investigation answers them from Microsoft 365 or Google Workspace logs and puts the answers in a report your bank, insurer and lawyer can use.

Logs age out. Microsoft documents a 180-day default retention for Audit (Standard) records, with Microsoft Entra sign-in logs kept 7 days without Entra ID P1 or P2 and 30 days with P1 or P2. Google Workspace keeps most log events for about six months. See business email compromise investigation, Microsoft 365 forensics and Google Workspace compromise investigation.

ITRS is headquartered at 7810 Keele Street in Concord (Vaughan), Ontario, with an office in Vancouver, and has done incident response and digital forensics since 2018. We take hacked-email matters across Toronto, York Region, Peel, Durham, Halton and the rest of Ontario, carry CA$2M in cyber liability insurance, work under counsel's direction when counsel is retained, and give expert-witness evidence when a matter goes to court.