This is sadly very common of late.

Hackers are gaining access to real email accounts and then simply using those email accounts to send spam. They may not even bother to change the password, but they may change a few other things to make it easier for them to hack back in.

Here's a quick list of things I would do.

•

You Don't Have Access To Your Account

If you can't login yourself your options are severely limited. Your account has been hacked into, and the hacker has locked you out.

• Password Recovery - use the "I forgot my password" link on your account's login page to see if they'll send you a password reset or other means of regaining access to your account. There's a good chance hackers will have changed all the information that you would use to prove you are the rightful owner meaning it's likely that this will not work, but it's worth a try.

• Customer Support - contact the customer support department for the email service that you're using. That may be phone support, but more often than not for free accounts (where I see this happening most often) there is no formal email or phone based support. Typically there are just FAQs and occasionally a peer-to-peer support forum where users can help each other. Unfortunately, this type of problem requires help directly from the service.

If you're able to regain access to your account immediately proceed to the "You Do Have Access..." steps below.

You Can't Regain Access To Your Account

Unfortunately, I believe this to be the most common scenario, particularly with the larger free email services. As I mentioned above hackers will frequently change all the account recovery information associated with your account and you'll have no way to get it back.

• Create A New Account - you may already have done this, but you're going to need a new email account. It's up to you whether you want it to be on the same email service or not. This will be your new email account.

• Tell Your Contacts - email all your contacts that your email address has been changed, and that the old one was compromised and is not you. If you lost your contact list as part of all this, do the best you can - if you can't recover the account you can't get the contact list.

• Move On - there's little more than can be done. Move on with your life, there's not much point in spending a lot more effort and energy on this, other than to learn from it so that it doesn't happen again.

You Have Access To Your Account

If you have or regain access to your account there are several things you need to do immediately:

• Change Your Password - make it a good one. You know the drill: unique, hard to guess and (probably) hard to remember, don't use real words, do use a mix of upper and lower case, numbers and if allowed a symbol or two.

• Change Your Account Recovery Information - I can't over-emphasize how important this is. Change the answers to your secret questions; choose or make up new questions if you can. Confirm that the alternate email addresses associated with your account, as well as any phone numbers, are correct and yours. Remove any billing information like credit cards from the account. Any and all of this could be used by a hacker to regain access to your account almost immediately.

• Check For Forwards - if the email service provides the ability to automatically forward your email to another address, make sure the hacker didn't set one up. This is another way they could quickly regain access to your account.

• Check the Signature - if the email service provides the ability to automatically add a signature to your email, make sure the hacker didn't set one up turning every email you send into an ad for something.

• Back Up - most people miss their contact list the most, so back it up right away. Download it (often there's an "export" function that'll do) to at least have a copy of it on your own computer. Then look at ways to backup the email you have stored in your account; quite often the most effective approach is do access the account with a desktop email program and download all the mail using POP3.

It's important to note two things: first you must be thorough in checking all the information associated with your account so as not to leave a door open for the hacker to regain access, and second be aware that the hacker may regain access to your account anyway. They did it once, and we don't know how, so we don't know that they won't do it again. This makes backing up your information while you have access all that more important.

It's Typically NOT a Virus, But ...

When this happens people frequently assume that they have a virus. This is typically not the case. Most account hacks happen by other means.

However...

Take this opportunity to double check that your anti-malware tools are up to date, running, and are updating their database of malware daily.