Emails are being sent from our Gmail accounts in other people's names, accounting sent 50k

my gmail got hacked too. even though gmail changed the password, emails are still being sent. i spent 10 mins on google, turned on 2fa and got backup codes. no issues for 6 months

did this happen because google 2fa was off? if it was on, how can a hacker log in without a password? maybe the email relay (smtp) account was hacked instead of the main account?

add SPF / DKIM / DMARC immediately. check the 'Mail Forwarding' section in Gmail settings to see if there are any unauthorized forwards.

send an urgent email to clients saying 'accounting instructions will only be confirmed via phone number X, do not trust emails'.

open Google Security Checkup (myaccount.google.com/security-checkup) and go through all the company's Gmail accounts. check login devices and app passwords for each account.

i disagree with you on this point. the answer varies greatly by industry; there is no one-size-fits-all rule.

trying to do this alone is the most expensve way.

Timely topic. When making a decision, first look at what data you have on hand.

Your time to detect an issue directly determines its cost. Good luck with that.

Sorry, but this doesn't apply in every case. If it's your first time start small; scaling comes later.

Your time to detect an issue directly determines its cost. If you post the result here it will help others too.

quick summary for newcomers: Start with a small trial; don't commit to everything at once.

of course, it varies if your situation is different.

quick summary for newcomers: An untested backup is not a backup.

let me write how it's done in practice. tbh trying to do this alone is the most expensiive way.

this is my opinion I'm not claiming it's absolute truth.

We need to make a distinction here. Most incidents start with a leaked password, not a vulnerability.

Hope this helps.

I agree.

I've been dealing with this for a long time. If permission and scope aren't in writing, don't start that test.

Correct me if I'm wrong.

Correct.

I partly agree partly disagree. If permission and scope aren't in writing don't start that test.

Hasty decisions become decisions you have to fix six months later. Proven by experience.

Let me share what happened to me; it might be useful. Start with a small trial; don't commit to everything at once.

Good luck with that.

Thanks, this was very helpful. Taking measures without an inventory leaves doors you haven't seen open.

I'm also curious if anyone does it differently.