We have a mail server on CPanel, and we added the company email accounts from CPanel. We use outlook as the email client.

When we send emails to the procurement department, the hacker gets a copy.

enter image description here

enter image description here

How did this person get to automatically forward himself our emails?

I have been tasked with responding but I don't know where to start.

  • 1
    Do you have anyone named Mason on your team? It could be that one of the recipients is forwarding their work email to a personal email account so they can access work emails on their phone. Have you been able to replicate the issue? – Daisetsu Feb 7 '19 at 19:37
  • Have you tried emailing that address directly to ask what's going on? – Daisetsu Feb 7 '19 at 19:39
  • @Daisetsu No, we don't have anyone by that name and owns that email. we're small team of 10 employees only – Dr Deo Feb 7 '19 at 19:42
  • 1
    I would start by checking the initial email you sent out. Go into your sent folder and check if it lists that email in the CC field. If it's not there, then I would login and check your CPanel email configuration. Is CPaneol running the email server? – Daisetsu Feb 7 '19 at 19:54
  • 1
    It looks like you are forwarding to an email list (it does not look like a single recipient's email ) and the email address for the user "sales125.mason" has been deleted or it could not be forwarded due to some reason. I do not think it is anywhere related to hacking. – tech_enthusiast Feb 8 '19 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.