It’s Not If Your Email Gets Hacked, It’s When

Email breaches are inevitable. What matters isn’t whether a provider, or your own account, ever has a security incident. It’s how much damage is done when it happens.

Email is one of the oldest and most trusted tools on the internet. It connects family and friends, handles password resets, receives legal notices, manages finances and acts as digital proof of identity. Because it underpins almost everything online, it is also one of the most targeted systems there is. Reports from the UK’s National Cyber Security Centre and Verizon keep finding the same thing: stolen credentials and phishing are among the most common ways attackers get in, and email is where both of those land.

Accepting that an email breach is a matter of when, not if, isn’t alarmist. It’s realistic.

At a glance: the risk and what to do

Modern security assumes breach

In cybersecurity, the guiding principle is assume breach. Systems are designed on the expectation that something will eventually fail, and the aim is to limit, contain and recover from the damage rather than to count on perfection.

We wear seatbelts without expecting a crash, lock doors without expecting a burglary, and back up data before a drive fails. Email security needs the same practical approach.

An inbox is valuable for two reasons:

• Personal context: private conversations, subscriptions, travel plans, receipts and medical records build a detailed profile over time.
• Control: the inbox resets passwords, verifies identities, receives one-time codes and authorises new devices for almost every other account you have.

For an attacker, getting into an inbox often means getting the keys to someone’s entire digital life.

Major email breaches

Large email services host billions of accounts, which makes them permanent, high-value targets. A few incidents show how this plays out at scale, and none of them needed the user to do anything wrong:

If you want to know whether your own address has already turned up in a breach, see my guide to Have I Been Pwned and breach risks for email.

Common entry points for account takeovers

Breaches rarely need nation-state zero-day exploits. Verizon’s 2025 Data Breach Investigations Report found that credential abuse was the most common way in (22% of breaches), followed by exploited vulnerabilities (20%) and phishing (16%). Most account takeovers come down to a few structural weaknesses:

• Password reuse and weak passwords: passwords stolen in other breaches let credential-stuffing bots unlock email accounts automatically.
• No multi-factor authentication: with a password alone, one leak is enough to lose the inbox.
• Phishing and social engineering: urgent-sounding messages trick people into handing over access, and support and recovery processes are often manipulated too.
• Session and token theft: attackers steal or forge authentication tokens to skip the login screen and MFA checks entirely, as the Yahoo cookie and Storm-0558 incidents showed.

Business continuity: keeping the business running

For freelancers, sole traders and businesses, an email breach isn’t just a privacy headache. It’s an operational crisis.

When your email goes down or gets locked, the business grinds to a halt:

• Lost revenue: quotes can’t be sent, invoices go unpaid and new leads go to competitors.
• Damage to your reputation: attackers often use hijacked business accounts to send phishing emails or malware straight to your clients and suppliers, which destroys trust quickly. Fake “our bank details have changed” invoices are a classic.
• Legal and regulatory exposure: losing control of customer data can mean reporting the breach to the ICO, usually within 72 hours, and penalties under UK GDPR.

Building resilience into your email setup means that even during an incident, your business can keep operating, talking to clients and getting paid. I cover the bigger picture in email as a single point of failure.

Reducing the blast radius

No provider can guarantee absolute protection. The real difference between email services is their blast radius: how much data is exposed, whether message contents can be read, and how easily you can get your account back.

One of the most effective ways to limit the damage and keep going is to separate your email address from the provider that hosts it. When you use your own domain, a breach or lockout doesn’t destroy your digital identity or stop your business, because you can point the domain at a new provider. I explain how in why using your own domain for email makes sense.

Aliases help too. If every shop and service gets its own address, a leak from one of them can’t be used to find your main login, and you can switch that alias off. See what password managers do and why aliases matter.

Privacy as a boundary

Privacy is not about hiding wrongdoing; it is about setting boundaries. Closing your curtains at night is a normal boundary, not an admission of guilt. Email deserves the same protection. When security fails, the real cost is rarely just money. It is lost time, real stress, compromised linked accounts and the slow, painful job of rebuilding trust.

What I’d do

Treating email as disposable ignores how much depends on it. Judge an email service on how it limits damage, protects your identity, keeps you running and handles recovery. Then do your part:

1. Use a unique, strong password for your email, stored in a password manager.
2. Turn on multi-factor authentication, and use a passkey or a hardware security key where your provider supports it.
3. Check forwarding rules, filters and connected apps every few months, and remove anything you don’t recognise.
4. Keep recovery details current and store recovery codes somewhere safe and offline.
5. Use your own domain so a lockout or provider breach doesn’t cost you your address.

FAQ

How do I know if my email has been hacked?

Common signs are sent messages you didn’t write, password reset emails you didn’t request, unfamiliar devices or sign-in locations in your security settings, and new forwarding rules or filters. Check those settings directly, not via a link in an email.

What should I do first if my email is compromised?

Change the password from a device you trust, sign out of all other sessions, turn on or reset multi-factor authentication, then remove any forwarding rules, filters and connected apps you didn’t set up. After that, change passwords on the accounts that use that address for recovery.

Does multi-factor authentication stop every attack?

No. It stops most password-based attacks, but stolen session tokens and real-time phishing can get around SMS codes and app prompts. Passkeys and security keys are much harder to phish.

Would using my own domain stop a hack?

No, but it limits the fallout. If you are locked out or your provider fails you, you can move your domain to another provider and keep your address.

Note: checked and updated 17 October 2026. Sources: NCSC reports and advisories, Verizon Data Breach Investigations Report, CBS News: 3 billion Yahoo accounts breached, Fortune: Yahoo forged cookies, BleepingComputer: Exchange attacks, The Record: Storm-0558, TechTarget: Midnight Blizzard, Infosecurity Magazine: 2025 DBIR.