Home > Empowering Tips > What to Do When Hackers Have Your Email Address

Have you recently noticed a sharp increase in junk mail? Are you receiving strange, overly personal emails that seem to know where you work or who your boss is?

This isn’t just random noise. It is often the first indicator that your professional email address has been leaked in a data breach. When your address falls into the wrong hands, you haven’t necessarily been “hacked” (meaning they don’t have your password yet), but you have been put on a target list.

Hackers use this contact information to prepare for highly personalized, dangerous attacks called spear phishing. They are gathering intelligence and testing your defences before attempting to break into your account. Treat that influx of spam as a warning siren.

Phase 1: Harden Your Defences Immediately

Your goal is to secure the perimeter before a “leak” becomes a “breach”.

• Stop Password Reuse: If you use the same password for your email as you do for other websites, change your email password immediately. Assume that if hackers have your email address, they will try to “guess” your password using data from other leaks.
  Pro Tip: Use a Password Manager to create long, unique passwords so you don’t have to memorize them.
• Enable Multi-Factor Authentication (MFA): MFA is your ultimate shield. It requires a second code after you enter your password. Even if a hacker correctly guesses your password, they cannot get in without that second code.
• Check Your Visibility: Use reputable tools like Have I Been Pwned to see which specific data breaches included your email address. This helps you know which other accounts might also need a password refresh.

Phase 2: Spot the “Professional” Scams

Because hackers know your email and where you work, their scams will look much more convincing than typical “I inherited a million dollars” spam.

• The Urgent Request: Be suspicious of any email — even if it looks like it’s from your CEO — that demands immediate action, asks you to buy gift cards, or requests a wire transfer due to an “emergency”.
• The “Unpaid Invoice” Scam: You may receive an email from a “vendor” or “supplier” claiming that a payment is overdue. It often includes an “invoice” attachment (which is actually malware) or a link to a fake portal to “update your payment details”.
• The “Payroll or Settlement” Trap: Hackers often send fake emails pretending to be the Payroll Department. They may mention “upcoming payments”, “salary revision”, or “employee sanctions” to trigger curiosity or panic. Never open attachments in these emails; instead, verify directly through your company’s official HR portal.
• The “IT System Update”: You might get an email that looks like a technical alert, stating your password is about to expire or your mailbox is full. It will provide a “Sign-in” link to resolve the issue. This is a classic trick to steal your login credentials on a fake login page.

Phase 3: Report and Stay Alert

If you receive an email that feels “off,” simply deleting it isn’t enough. Taking an extra minute to report it can protect your entire team.

• The “Hover” Test: Before clicking any link, hover your mouse over it. A small box will appear showing the actual destination. If the link says YourCompany.com but the hover text shows RandomSite.ru, it’s a trap.
• Report to the IT Team: If you spot a suspicious email, forward it immediately to the IT Department or your designated Security Team. They can analyze the headers of the email, block the sender’s domain for the whole company, and check if any other employees have been targeted.
• Alert the Email Service Provider: If you are using a professional mail service, you can usually report the email directly to the provider for review. This helps improve the global filters that catch these scams before they even reach an inbox.
• Tune Your Mental Filters: Once your email is on a “leak list”, expect more attempts. Remain cautious about what you share publicly online (like on LinkedIn) as hackers use that info to make their next scam even more convincing.

Conclusion: Stay One Step Ahead

Finding out your email address is in the hands of hackers can be unsettling, but it doesn’t have to be a disaster. In the digital workplace, your email address is essentially your professional “front door” — just because someone has the address doesn’t mean they have the key.

By staying vigilant, questioning “urgent” requests, and leaning on your IT team for support, you turn a potential security breach into a minor inconvenience.

Frequently Asked Questions (FAQ)

1. Does “leaked” mean the same thing as “hacked”?

No. A leak means your email address is on a list of contacts. A hack means they have actually accessed your inbox. A leak is usually the “scouting” phase before an attempted hack.

2. Why should I care if they “only” have my email address?

Because they can use it to send you “phishing” emails (like the Payroll or Invoice examples) that look real, hoping you’ll eventually click a link and give up your actual password.

3. Why am I suddenly getting more spam than my coworkers?

Your email address was likely included in a specific database leak (from a website or service you signed up for) that your coworkers didn’t use.

4. Is it safe to click “Unsubscribe” on these new spam emails?

Be careful. On suspicious spam, clicking “Unsubscribe” tells the hacker that your email is active and being read, which often leads to more targeted attacks.

5. Should I get a new email address?

In a professional setting, no. Simply secure your current account with a strong, unique password and Multi-Factor Authentication (MFA). This makes your email address useless to a hacker.