Email account taken over after a data breach

look in the sent folder and the deleted items too. if they sent anything out (scam messages, password resets for your other accounts) you'll see what they were after, and you'll know which contacts to warn. longer term a password manager is what actually stops this happening again, every site gets its own password and one breach stays one breach.

Go through the provider's account recovery from a device you trust, not the one you think might be infected. Use an old password you remember or your recovery phone, whatever it asks for. Once you're back in, in this order: - change the password to something you've never used anywhere - sign out of all other sessions/devices - check the recovery email and phone haven't been swapped for theirs - look at forwarding rules and filters, attackers love adding a rule that quietly forwards or deletes mail - remove any app passwords or connected apps you don't recognise - turn on two-step verification Then change passwords on anything that can be reset through that inbox, banking and shopping first. Since it came from a breach, any other site where you reused that password is exposed as well.