After a breach involving a shared family inbox, protect other family members by changing every reused password and turning on multifactor authentication. Then remove hidden forwarding rules and move each person to a separate email account. A shared inbox means several family members use one mailbox and often reuse its password elsewhere. A single stolen password can then expose bank resets, school accounts, and private mail for everyone sharing it.
Table of Contents
- Change the exposed password everywhere it was reused
- Turn on multifactor authentication for each person
- Remove hidden forwarding and inbox rules
- Stop sharing one inbox
- Get a tailored recovery plan
Change the exposed password everywhere it was reused
Start with the breached password. The FTC advises changing that password right away and every other account that reuses it, in its FTC breach advice. Attackers test stolen passwords on email, shopping, banking, and social sites.
Give each account its own password. Use a password manager to create and store unique passwords without memorizing them. That step stops one leak from unlocking many family accounts.
Turn on multifactor authentication for each person
Multifactor authentication requires more than a password, such as a code, app approval, or fingerprint. CISA advises individuals and families to use strong passwords plus a password manager and turn on multifactor authentication, in its CISA family guidance.
Prioritize email first, then money and social accounts. CISA specifically names email, financial accounts, and social media as the most important data to protect. Add authentication to every account that offers it, for each family member separately.
Remove hidden forwarding and inbox rules
Changing a password alone does not remove silent forwarding or auto-delete rules. An attacker can keep receiving copies even after the password changes.
Microsoft directs responders to clear "Forward all email sent to this mailbox" and review Inbox rules for suspicious entries, in its Microsoft compromised-account response. Check the mailbox before family members resume normal use: Google's hacked-account guidance also calls for checking delegation, automatic forwarding, filters, and unfamiliar labels. Disable or delete anything the family did not add.
- Forwarding and POP-IMAP settings for unknown addresses
- Filters and rules that forward, delete, or mark messages read
- Mail delegation, labels the owner did not create, and connected apps
- Recovery email, recovery phone, and recent activity
Stop sharing one inbox
Move each family member to a separate email account with a separate password. CISA's campaign checklist treats each person's email and devices as separately needing strong passwords and two-factor authentication. Separate accounts limit damage from the next breach.
Update password resets and school, medical, bank, and shopping logins to use the new addresses. Remove old credentials from shared phones, browsers, and notes. Keep one emergency contact list so relatives can reach each person without sharing mail.
Get a tailored recovery plan
Enter what was exposed at IdentityTheft.gov/databreach to get a tailored plan, as the FTC recommends. If a Social Security number was exposed, that plan includes ordering free credit reports and checking for unrecognized accounts. Act quickly for children and older relatives, because misuse of their details may stay hidden longer.
You Might Also Like
- Data Breach Follow-Up Scams: Why a Caller May Know Your Real Account History
- Data Breach Exposed an Old Address? Why Outdated Information Can Still Be Useful to Scammers
- Data Breach Exposed Your Phone Number: Warning Signs of an Attempted SIM Swap