How do I recover from an email breach?

Question

A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails waiting for me in the morning: recently it's been more like 1 email.

Last night I got up in the middle of the night local time (US Central), and saw five unread emails. I answered one and went back to bed with the others untouched. In the morning, I got up and to my surprise found one unread email. I changed my password to something generated from cjshayward.com/passwords. I also set up a separate email account on Hotmail.

Conversation with the editorial team revealed that there were apparently several emails my editor had sent me and was presumably wondering why I hadn't responded. I addressed the points the team had raised in their email and asked for correspondence to be sent to the new address.

What, if anything more, should I do from here? I don't trust my email filters 100%, but if I introduced a bug filtering, they don't account as far as I can tell for my leaving four unread messages, after all my filters had already been applied, and then coming back and finding only one unread email left. How should I contact Gmail for any help?

Thanks...

Answer 1

These links might help you:

• Compromised Gmail Account

  Start from here, this is the main page that listed the resources and actions you can take to recover from compromised account.

• Gmail Security Checklist

  Among the more important measures, other than changing passwords, are checking account recovery options, checking recent activities on your account, enabling 2-factor authentication, checking your contact books for altered data, and several gmail specific actions like external applications that are granted access to your accounts and email forwarding. Do follow through the entire checklists though.

• Find missing email

  Do follow through the wizard on that page for options to recover your messages. Also important is to check your Trash box, less sophisticated attackers might have left your deleted messages from the Trash.

• My messages have gone missing

  Even if your message has been deleted from your view, Gmail might still be able to conduct manual investigation to recover your deleted messages. Do follow this contact page.

• Restore contacts

  If you believe your contact book might have been compromised, you can recover your contact book to the state it was at any point in time during the last 30 days.

Answer 2

At the bottom of the page in Gmail, you should see something like this:

If you click the 'Details' link, you will get a pop-up window showing all the recent IP addresses used to access your account, along with some other information.

You can probably use this to determine if someone else has been logging into your account.

You can also set up 2-factor authentication for Gmail to make it harder for someone to break into your account.

I wouldn't suspect a mistake in your filters, since you saw the messages in the first place. A filter would act on the emails coming in as they come in, so you either wouldn't see the messages at all, or you would see them, and they would stay put until you (or someone) deleted them.

As an aside, I would suggest never having a filter delete a message outright, and only have them move messages to the trash. This way, you can still save mistakenly filtered messages if you notice them in time.

It is possible that the spam filters retroactively marked some messages as spam, so you can look in the spam folder to see if they are there. I don't think this is a very likely scenario, though.

Answer 3

Google has its own page for this: https://support.google.com/mail/checklist/2986618

Some items from this (and my own $0.02) that I think are worth emphasizing:

• Check where the account has been logged in from (https://support.google.com/mail/answer/45938?hl=en) and other recent activity. This will be the most telling.
• Check the administration settings to ensure that the email accounts that can be used for password resets are expected.
• Gmail allows for 2 factor authentication. I strongly recommend using it. (Single best defense against this). Or more bluntly: USE IT!
• Ensure that no forwarding or similar rules have been put in place.
• Check your deleted items (though items could have been cleared out of there).
• Being extra safe: Any systems that you have that can send password resets to your gmail account, change their passwords. (Especially high value systems).