Our news
A leaked password is all it takes: how an attacker gains access to corporate email
A leaked password is a credential that has fallen into the wrong hands due to a breach, a phishing email, or spyware. If it grants access to corporate email and there's no two-factor authentication, the attacker can gain entry as if they were an employee. They don't break anything, and no alarms are triggered.
It's one of the simplest and most cost-effective ways to attack a company, and therefore one of the most common. We explain how an attacker does it step by step and what signs they leave behind. We also explain what to do to ensure a stolen password is useless to them.
How does a password end up in the hands of an attacker?
There are three main ways. The first is through breaches on other websites: if an employee reuses a password for their email and on an online store that suffers a data breach, it ends up circulating on lists. The second is phishing, a fake email that mimics a login screen.
The third method involves spyware that steals passwords saved in the browser of an infected computer. With any of these three methods, the attacker only needs to try the username and password combination. According to Microsoft's 2025 Digital Defense Report, over 97% of identity attacks are password attacks.
How an attacker gains access with a leaked password, step by step
The attack isn't a quick strike, but a silent occupation that can last for weeks. The attacker is in no hurry: they want to know your company from the inside out before acting. This is the typical process until they obtain a benefit, usually financial:
- Try accessing: Log in to webmail or Microsoft 365, often from a foreign country or through a VPN.
- It hides: It creates rules that move or delete reply emails, so the employee doesn't see anything unusual.
- Note: Read conversations with customers and suppliers, learn how to write in the company, and detect outstanding payments.
- Take action: send an invoice with a changed account number or request an urgent transfer from a real address.
- It extends: He uses the mailbox to send phishing emails to other employees or customers, who trust him because the sender is authentic.
This fraud has a name: business email compromise, or BEC. FBI report on cybercrime, The report, published in April 2025, recorded 21,442 such complaints in 2024. Losses approached $2.8 billion in the United States alone.
What signs indicate that someone has accessed your email?
The signs are often subtle and easy to miss because the attacker tries to avoid drawing attention. Even so, there are indicators worth checking regularly, especially in the email inboxes for management, administration, and purchasing, which are of most interest to those seeking payment.
| Sign | What could it mean? |
|---|---|
| Forwarding or deletion rules that no one created | The attacker hides their emails or forwards copies to themselves. |
| Logins from other countries or unusual hours | Someone is using the password from outside |
| Responses to emails that the employee did not send | Messages are being sent from the mailbox |
| Customers asking about a bank account change | There is a manipulated invoice in circulation. |
What to do if you suspect a password has been leaked?
Act quickly and systematically, because every hour counts. The goal is to remove the attacker, close any open doors, and notify anyone who might be affected. If you only change the password, the attacker can remain inside thanks to their rules or an open session.
- Change the password and close all open sessions on that account.
- Review the mailbox rules and deletes those that were not created by the employee.
- Activate the second factor in that account and in the accounts of the rest of the company.
- Notify customers and suppliers that they do not process bank account changes without confirming them by phone.
- Review the access log to find out how long he had been inside and what he had seen.
How to prevent a leaked password from opening your email
The most effective measure is two-factor authentication. With it, a leaked password isn't enough, because the attacker would also need the employee's mobile phone or physical key. According to the same Microsoft report, phishing-resistant multi-factor authentication stops more than 99% of these attacks.
In addition to that, there are other simple measures: don't reuse passwords and use a password manager. Also, block logins from countries where you don't work and train your team to recognize fake emails. We explain how we implemented this on our page about [the topic/the topic]. Multi-factor authentication for businesses.
How can Apen help you protect your email?
At Apen, we review your email and Microsoft 365 access credentials and look for suspicious rules. We also check if your team's accounts appear in any known data breaches. Then, we phase in two-factor authentication with conditional access policies to ensure everyone has access to their work.
We've been working with SMEs in the Vallès and Barcelona areas for over 35 years. If you think someone has accessed your email, call us at 938 606 220. To prevent this, request your free diagnostic and we'll tell you which accounts are most vulnerable.
Frequently Asked Questions
How do I know if my password has been leaked?
You can check this using services like Have I Been Pwned, which alert you if your email address appears in a known data breach. In a business setting, it's advisable to check this for all accounts periodically.
Is it enough to simply change your password after an attack?
No. The attacker can still access the system through open sessions or rules they've created. You need to close the sessions, review the rules, and enable two-factor authentication.
Why doesn't the attacker act immediately?
Because he wants to get to know the company beforehand. He waits to find an invoice or a significant payment to make the fraud seem credible, and sometimes weeks go by.
Does antivirus software protect email from a leaked password?
No. The attacker logs in with a valid username and password, so as far as the system is concerned, it's legitimate access. What's stopping them is the second factor.
What is business email fraud?
It's a scam where the attacker uses a real mailbox or one that mimics it to request payments or change bank account details. It's known as BEC (Business Email Compromise).
Do we need to notify anyone if someone gets into the company email?
If personal data is affected, the GDPR requires notification to the data protection authority within 72 hours. It is also advisable to notify customers and suppliers.
