Change the mailbox password straight away, then remove any forwarders or filters the attacker added and put the new password on every device. If the mailbox has been sending spam, tell us so we can check what it sent.
Typical signs: contacts get messages you never sent, you receive bounces or replies to mail you didn’t write, mail disappears from your inbox, or the mailbox is suddenly blocked from sending.
Do this now
- Change the password from a device you trust. In cPanel, open Email → Email Accounts, click Manage next to the mailbox, enter a new password under Security and click Update Email Settings. Use a long password you have never used anywhere else. If you used the same password for cPanel or the client area, change those too.
- Delete forwarders you didn’t create. Open Email → Forwarders. Attackers often add one so they keep receiving copies of your mail after the password changes.
- Check filters. Open Email → Email Filters and Email → Global Email Filters. Delete any rule that forwards, redirects or deletes mail, especially one that hides messages mentioning invoices, payments or bank details.
- Check autoresponders and webmail settings. Look in Email → Autoresponders, then sign in to webmail and make sure your name, signature and reply-to address haven’t been changed.
- See what was sent. Email → Track Delivery lists recent messages sent from the address, so you know who may have received fake mail.
- Update every device. Put the new password into your phone, laptop and any other app that reads this mailbox. A device that keeps trying the old password can get your office’s IP address blocked by the server firewall.
- Scan your computers. If malware stole the password, it will steal the new one too. Run a full antivirus scan on every computer that uses the mailbox.
Then limit the damage
- Warn your contacts. Tell customers and suppliers, by email or WhatsApp, to ignore messages sent while the mailbox was compromised, and that your bank details have not changed. Fake invoices sent from a real mailbox are where the money is lost.
- Tell us if it sent spam. Open a ticket with the address and roughly when it started, so we can check what went out and whether any spam is still waiting to be sent.
- Think about personal data. If the mailbox held customers’ or staff personal information, Zimbabwe’s Cyber and Data Protection Act requires the data controller to notify POTRAZ within 24 hours of becoming aware of a breach. See What does the Cyber and Data Protection Act mean for my website? This is not legal advice.
Tip: Most mailboxes are taken through a fake login page or a reused password. Never type your email password into a page you reached from a link in an email: go to yourdomain.com/webmail yourself.
Business email plans include two-factor login for mailboxes, so switch it on once the mailbox is clean. To catch phishing and invoice fraud before it reaches your staff, see Armor Mail.
Still stuck? Open a support ticket with the email address and what you have seen, or message us on WhatsApp.
Updated 6 November 2026. Something here out of date? Tell us.