A business mailbox is the key to many other services: it's where password resets, invoices, and contracts arrive. This article is for employees and administrators. It covers how to choose and store passwords, why two-factor authentication matters, and what to do, step by step, if a mailbox is compromised anyway.
How mailboxes usually get hacked
Mailboxes are rarely lost to sophisticated attacks. The usual causes are much more ordinary:
- Phishing. An employee types their password into a fake sign-in page. See our article on phishing emails.
- Password reuse. The email password is the same as one used on a website whose database was stolen. Attackers automatically try these username and password pairs on mail servers.
- Password guessing. Simple passwords like
Company2024or12345678are found with dictionary attacks. - An infected device. Malware captures passwords as they're typed or steals the ones saved in the browser.
What makes a password strong
What matters most is length and unpredictability, not a sprinkling of special characters.
- Use at least 12 to 14 characters. A good option is a passphrase made of several random words, such as
lamp-river-pencil-green. - Avoid your company name, people's names, birthdays, phone numbers, and keyboard patterns like
qwerty. - Your email password should be unique. Don't use it anywhere else.
- Don't change passwords on a fixed schedule for no reason. That leads to passwords like
Password1,Password2. Change it when you suspect a leak.
Password managers
Nobody can remember dozens of long, unique passwords, so store them in a password manager. It's an app that generates random passwords, keeps them encrypted, and fills them into sign-in forms. You only need to remember one master password.
| How passwords are stored | Verdict |
|---|---|
A sticky note on the monitor, a passwords.txt file on the desktop | Unsafe: anyone with access to the computer can see it |
| The same password everywhere | Unsafe: one leaked site exposes all the others |
| Saved in the browser | Better than nothing if the device is password-protected and not shared |
| A password manager with a strong master password and 2FA | Recommended |
Password managers also help against phishing: they only fill in a password on the site it was saved for. If your manager doesn't recognize a sign-in page, take a closer look at the address bar.
Two-factor authentication
Even a good password can leak. Two-factor authentication adds a second sign-in step: a code from an authenticator app (TOTP) or a WebAuthn/FIDO2 hardware key. Without it, a stolen password alone isn't enough to get into webmail.
Turn on 2FA first for the mailboxes of executives, accounting, and the domain administrator, since they're targeted most often. If your administrator has turned on two-factor authentication, ask support how to connect your desktop or mobile email app.
Brute-force protection
Mail servers on the internet constantly receive password-guessing attempts. MCMail has brute-force blocking turned on: after a series of failed sign-in attempts, the address they come from is temporarily blocked. That makes dictionary attacks slow and ineffective.
It's important to understand the limits of this protection. It can't help if a password has already leaked through phishing or another website. Brute-force blocking, a unique password, and 2FA only work well together.
If an employee's email app keeps connecting with the old password after it's been changed, it can get your office IP address blocked. After changing a password, update it right away on every device: phone, laptop, and tablet.
If your mailbox has been hacked: step by step
Signs of a compromise: colleagues receive emails you didn't send; there are unfamiliar messages in Sent; incoming mail disappears; you get notices about a password change or a sign-in from a new device; you can't sign in with your password.
- Change your password from a device you know is clean. If you can't sign in, contact your domain administrator or support to regain access.
- Turn on or reset 2FA. If a second factor was already enabled, check that no unknown keys or devices have been added.
- Review your mailbox settings in webmail: filter rules, forwarding, auto-reply, and signature. Attackers often create a rule that forwards all mail to an outside address or deletes replies to the messages they sent.
- Update the password on all your devices and remove the account from any device you no longer use.
- Scan your computer with antivirus software. If the password was stolen from an infected device, the new one will be stolen the same way.
- Warn colleagues and partners if messages were sent in your name, especially ones asking for payment.
- Change passwords for other services that can be reset through this mailbox or used the same password.
- Contact support at @mycloudsupport. We'll help you check where sign-ins came from and whether the mailbox is sending spam.
If spam was sent from the mailbox, outgoing mail may be restricted and your domain's reputation may suffer. The faster you change the password, the smaller the damage.
Tips for domain administrators
- Delete or block a departing employee's mailbox on their last day. In MCMail, the domain administrator creates and deletes mailboxes on their own.
- Don't share one password among several people. For shared addresses like
info@, use aliases and forwarding instead. See our article on aliases and filters. - Keep the administrator password separate from the others and protect it with 2FA.
- Remember that the server-wide backup is not a personal archive: restoring individual deleted messages isn't guaranteed. If an attacker deletes important correspondence, you may not be able to get it back, so keep extra copies of important messages.