Help!! My business email has been hacked using my.com/my.mail.com

[Anonymous]

Early this morning, I received an email from my.com that my account had been created to consolidate and manage my emails. The problem is that I didn't sign up for any such service. I googled for a couple of minutes, but it was a bit unclear and I wasn't able to gleam much. I was in the middle of a work project so I put it off to deal with later (also thinking it was perhaps some sort of phishing scam).

I worked all day and stupidly closed Outlook as I'm working some large files that bog down my system. About an hour ago, I went to check Instagram and my profile name had been changed as well as the email associated with my account. Instagram indicated and emails had been sent to my email address this afternoon confirming the changes. Somehow, after numerous attempts, I was able to get back into the account from another device. I changed everything back and of course changed the password. While I was doing this, another email came through confirming my registration with Humble Bundle. I clicked through to the link and quickly changed the password so the account couldn't be accessed again.

I run a small business and own my domain. My email is hosted on Bluehost. I logged into Bluehost and changed all of my passwords. I also changed passwords on other social accounts as well as banking.

They obviously had direct access to my email as they were able to delete all of the Instagram notifications as well as the email from this morning from my.com (it's no longer in my inbox or trash - so must have been hard deleted).

But, I was still able to access my Bluehost account - they didn't lock me out. I am not all that tech savvy - so what am I missing? Any advice is appreciated.

[Anonymous]

This is a pretty big hack and as it covers both your business and personal accounts, I would be overly cautious.

1. Freeze your credit.

2. Alert anyone you are legally required to alert about a possible breach

3. You should assume all your devices are compromised. Hard wipe a device or boot into a linux recovery disk and use that device, and only that device to change your passwords and access accounts until things are under control.

4. Call your banks and credit card companies and alert them to the hack. Make sure they update all your trusted devices and add any additional security features they can.

5. Call bluehost and talk to someone. Make sure they update all your trusted devices and add any additional security features they can. Pay them, if needed and possible, to do forensics to figure out where the hack came from.

6. Alert anyone else that may have been comprised.

7. Enable two factor authentication on every account that supports it. Consider switching services that do not support 2FA

8. Download a password manager and change all your passwords to secure random string passwords. Change all security question/answers to random string answers. Do not reuse passwords or easy to remember passwords.

9. Systematically backup your data, wipe the machines, and selectively and carefully restore data.

10. Have a scotch while you review IT service providers

Steps 9 and 10 can be swapped depending on your tech comfort and work time crunch.