Google Workspace account hacked: what to do in the first hour
Right now, from a clean computer and a different admin account, reset the user's password and sign them out of every session in the Google Admin console. Then remove the attacker's back doors: app passwords, connected apps, Gmail forwarding and filters. The steps below take about 15 minutes.
Reviewed by the ITRS security team · Last updated
If a Google Workspace account in your business has been hacked, an administrator should reset that user's password and sign them out of all devices in the Admin console now, before anything else. Then call your bank if a payment may have been redirected, and keep every email, filter and log: you will need them to show what the attacker saw and sent.
This page is the Google Workspace version of our Ontario hacked-email call list, which covers who to phone and in what order. If your mail is on Microsoft 365, use what to do if a Microsoft 365 account is hacked instead.
Do these 5 things in the next 15 minutes
Write down the time of each step. Screenshot anything before you remove it: it is evidence.
Reset the password and sign the user out everywhere
In the Admin console, go to Directory > Users, click the user, then click Security. Click Password > Reset Password, then Sign-in cookies > Reset, which signs the user out of their Google Account on all devices and browsers. Google says it can take up to an hour to end current Gmail sessions. While you are on that page, open Recovery information and remove any recovery email or phone the user does not recognize.
Revoke app passwords and connected apps
On the same Security page, open Application-specific password and click Revoke on each entry, then open Connected applications and Remove any app the user does not recognize. Google notes that removing an app only cuts its access until someone signs in to it again, so block it for good later under your app access controls. See our third-party app access guide.
Find and delete forwarding, filters and delegates
Sign in to the user's Gmail with the new password. Go to Settings > See all settings, then check three tabs: Forwarding and POP/IMAP (click Disable forwarding), Filters and Blocked Addresses (delete any rule the user did not create, especially one that forwards, deletes or archives mail) and Accounts and Import (delete unknown accounts under Grant access to your account). To stop it company-wide, an admin can limit automatic forwarding under Apps > Google Workspace > Gmail > End User Access.
Check the login log for the attacker's IP addresses
Go to Reporting > Audit and investigation > User log events (formerly the Login audit). Filter by the user and widen the date range, since the default is the last 7 days. Look for Suspicious login events, sign-ins from unfamiliar IP addresses or countries, and 2-Step Verification changes. Add the IP ASN column to spot hosting providers, then export the results.
Require 2-Step Verification for the account
Only the user can turn on 2-Step Verification, but a super administrator can require it at Security > Authentication > 2-step verification for the user's organizational unit or group. On the user's Security page, confirm 2-Step Verification is on, and if backup codes may have been stolen, use Get backup verification codes > Generate new codes to cancel the old set.
What the attacker probably already did
In the Google Workspace takeovers we investigate, the attacker rarely just reads mail. Check each of these before you decide the incident is over.
- Set up forwarding or a filter, so copies of new mail keep reaching them after your reset. Step 3 removes them; your screenshots show when and where mail went, and User log events can show the forwarding address.
- Granted access to an app, so it can read mail without the password. Check OAuth log events under Reporting > Audit and investigation for apps authorized around the time of the break-in.
- Sent fake invoices or bank-change requests to your clients from the real mailbox. Check the user's Sent and Trash folders, and search Gmail log events for messages sent during the attacker's window. Warn those recipients by phone.
- Copied your contacts and data. Check Takeout log events for an export of the account. A contact list can also be copied without leaving a clear trace, so plan on the attacker knowing who your clients are.
Who you must tell in Ontario
Confirm your notice obligations with your own lawyer. Full list of regulators and triggers: who to tell after a cyber incident in Canada.
- Clients and staff whose personal information was in the mailbox. Under PIPEDA, a business must report to the Privacy Commissioner of Canada a breach of security safeguards that creates a real risk of significant harm, notify the affected people as soon as feasible, and keep a record of every breach, reportable or not, for two years. Whether your breach meets that test depends on what the logs show the attacker reached.
- Your cyber insurer or broker, the same day. Policies usually set notice deadlines and may require approved vendors, so call before you hire anyone.
- Your bank's business fraud line, immediately, if any payment may have gone to a changed account. Ask for a recall attempt and a reference number.
- Local police and the Canadian Anti-Fraud Centre, at reportcyberandfraud.canada.ca or 1-888-495-8501, Monday to Friday, 10 a.m. to 4:45 p.m. ET. The CAFC says investigating is the role of your local police. Organizations can also report to the Canadian Centre for Cyber Security.
What not to do
- Do not delete the user or the mailbox. Deleting an account removes the mail, filters and history that show what happened.
- Do not clean up before you record. Screenshot forwarding, filters, delegates and connected apps, and export the logs, before you remove anything.
- Do not reply to the attacker or warn clients from the hacked mailbox. Phone them from a number you already have.
- Do not pay anyone who claims to be holding your data or offers to recover your money. Report it to police and the CAFC instead.
When to call a forensics firm
Call if money moved, if client or patient information was in the mailbox, if your insurer or lawyer needs a written account of what happened, if an administrator account was hacked, or if you cannot tell how long the attacker was in. A password reset ends the access. It does not tell you what was read, sent or downloaded.
Our Cyber Forensics & Assurance practice handles Google Workspace compromise investigations for businesses across Toronto, the GTA and Ontario. In the first 24 hours we confirm the attacker is out, export and preserve the Admin console logs before they age out, map the access window, list the messages sent and the files reached, and give you a short written summary your insurer, bank and lawyer can work from. We work under your lawyer's direction when one is retained.
Call our 24/7 incident line at (289) 582-9930, or send the details through our contact form.
Questions about a hacked Google Workspace account
Google Workspace support can help an administrator regain access and explain settings. You contact it from the Admin console with Get help, and you need the Support administrator privilege. It does not produce a forensic account of what the attacker read or sent for your insurer or lawyer. That comes from your own Admin console logs.
Under PIPEDA, yes if the breach involves personal information and creates a real risk of significant harm: report to the Office of the Privacy Commissioner and notify the affected people. Every breach must be recorded and the record kept for two years, even if it is not reported. Your insurance policy and client contracts may add their own notice rules.
Sometimes, if the bank acts before the funds are moved on. Call your bank's fraud line the moment you suspect a redirected payment, ask for a recall, then report to police and the CAFC. Nobody can promise recovery, and anyone who guarantees it for a fee is likely running a second scam.
No. A reset does not remove forwarding, filters, delegates or connected apps the attacker set up, and existing Gmail sessions can take up to an hour to end. Reset the sign-in cookies too, then work through all five steps above.
Related reading.
- GuideWho to call if your company email is hacked in OntarioThe calls to make, in order, when a business mailbox in Microsoft 365, Google Workspace or another service has been taken over, and what each one can and cannot do for…
- ServiceGoogle Workspace compromise investigationWhen a Gmail account in your Google Workspace organization is taken over, we use the Admin console's audit and investigation tools to establish what the attacker did…
- GuideInvestigating incidents with the Google Workspace investigation toolWhen something goes wrong in Google Workspace, the evidence is in the alert center, the audit and investigation logs and, on higher editions, the security investigation…
- GuideControlling third-party app access in Google WorkspaceEvery 'Sign in with Google' button and every add-on that asks to 'see, edit and delete your Drive files' is a third-party app with a token to your data.
- GuideWhat to do if clients receive fake invoices that look like they're from youWhen clients forward you an invoice you never sent, the first question is whether someone is spoofing your domain from outside or sending from inside your real mailbox.
- GuideWhat to do if you sent a payment to a fraudsterIf a wire, EFT or cheque went to an account controlled by a fraudster, the first hour matters most. Call your bank before you do anything else.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.