An afternoon phone call: a family’s email account had been hacked. Threats and ransom demands were going out from their own address — the address they had used for years for banking, online shopping and dealing with public authorities. As a precaution, they had already had the account suspended by their provider that morning and changed the password.
The question on the table is always the same: is the attacker sitting on our devices?
The case is described here in anonymised form. Names, address, date and provider have been left out or generalised. It’s a good illustration of how I work through something like this — and that a systematic check can end with good news.
Listen first, scan second
Before I touch a single device, I ask about the symptoms. Not out of politeness, but because the answers decide half the case.
Here the account was unambiguous: emails and nothing else. No windows that refused to close. No ransom banners. No files that had suddenly become unreadable. And the family’s other email accounts were behaving normally.
That alone is a strong signal. Ransomware wants to be seen — it locks the screen and makes noise, otherwise nobody would pay. Malware that quietly harvests passwords, on the other hand, would have little reason to hit exactly one account and leave the others alone.
You still check. A hypothesis is not a finding.
Every device on the table
I ask to see every device that has access to the affected account, or ever had it. In this household that meant a Windows 11 laptop, a MacBook and an iPhone. An older Windows 10 laptop surfaced later, having been forgotten about — that happens often, which is why I always ask again at the end.
I started with the Windows laptop. Not out of preference, but because Windows is by far the most widely used system and therefore the most common target. You work from the likely towards the unlikely.
What I checked:
- An offline scan with same-day signatures. I used Microsoft Defender, built into Windows. It left its reputation as a stopgap behind a long time ago: at the independent AV-TEST institute in Magdeburg it regularly achieves top marks for protection — 6 out of 6 points in the June 2026 Windows 11 test, the same result as the paid competition. What mattered most here, though, was the word offline: the scan runs before Windows starts. Malware that hides from the antivirus engine while the system is running gets no opportunity to do so.
- Patch status. The operating system and Office were up to date, all security updates installed.
- Startup entries and services. This is where anything that wants to survive a reboot settles in.
- Running processes. Not a quick glance but observation over a period of time: unusual CPU load, suspicious disk activity, unfamiliar programs. Every system process carried a valid digital signature.
Result: nothing. The MacBook and iPhone were equally unremarkable, both fully up to date. The old Windows 10 laptop didn’t even have an email client installed and was therefore ruled out. (I advised against using it anyway — Windows 10 no longer receives security updates, so a machine like that is a standing risk on a home network, even though it had nothing to do with this incident.)
I also checked the smart home devices and streaming sticks in the house. None of them had any connection to the affected address.
No infection. No virus. No ransomware.
When you need to dig deeper
That isn’t the end of my toolbox. Where there is a concrete suspicion, built-in tools aren’t the end of the story — that’s when a boot stick comes out.
The idea behind it is simple and effective: the machine doesn’t start into its own Windows at all, but into an independent Linux system from a USB stick. Malware that actively camouflages itself during normal operation — hiding processes, masking files, tampering with the scanner — simply isn’t running. It sits on the disk as an ordinary file and can be examined from the outside, with no ability to defend itself.
There are good tools for this: Desinfec’t, the security system published by the German computer magazine c’t, which runs several scan engines across the system in parallel, or a Linux live system with ClamAV. On encrypted machines, drive encryption has to be suspended temporarily — harmless enough, but it costs extra time.
In this case I deliberately skipped it. The machine showed no symptoms at all, the offline scan was clean, the system current, startup entries and processes unremarkable — and every anomaly in the incident showed up in the account, not on the device. An additional deep scan would have cost the client another one to two hours for a foreseeably identical result.
Part of a sound diagnosis, to my mind, is being able to explain what you didn’t do. The step can be made up at any time — and if the signs point that way, I’ll do it without hesitating.
The real finding was somewhere else
Only once the devices were cleared did we have the provider unlock the account. That order matters: unlocking makes sense only after the password has been changed and the device is known to be clean. Otherwise you invite the attacker straight back in.
What appeared after the first login was unmistakable:
- The webmail interface had been switched to French. That doesn’t happen by itself, and it isn’t a typical side effect of malware either. A logged-in human does that.
- More than 2,500 messages had been moved from the inbox to the trash folder.
- Only the threatening emails were left in the inbox. An emptied inbox with precisely the extortion messages still sitting there is not a side effect — it’s staging. The family was meant to see nothing but the demand when they opened their mail.
That made it clear what had happened: an account takeover, not an infection of the devices. Every one of those actions works through a simple login to the webmail interface — from anywhere in the world, without any access to a family computer. And the fact that their own address appeared as the sender isn’t a trick: whoever is inside the account sends through that account.
After the password change, nothing more happened. No further messages sent, no new threats. The access was gone.
How do strangers get hold of a password like that?
I couldn’t establish the specific route on site — as a rule only the provider’s login logs can do that, and the police request those. The usual routes are a short list, though:
- Credentials from a data breach at some other provider where the same address was used with the same password.
- Phishing — a fake login page where you enter the password yourself.
- A weak or reused password.
Points 1 and 3 go together and are by far the most common cause. A single breach at an online shop is enough if the same password also protects the mailbox.
What you can take away from this
Five things that would have prevented this case, or made it far less painful:
Turn on two-factor authentication. The single most effective step there is. Knowing the password alone no longer gets anyone in. It would very probably have been enough here.
A separate password for every account. Reuse is the reason a breach at provider A turns into a takeover at provider B.
Use a password manager. There’s no other realistic way to handle long, unique passwords day to day. One strong master password, and the software does the rest.
Your email account is your most important account. Password resets for every other service run through that address. Whoever holds the mailbox holds everything else sooner or later. It deserves your best protection — not the same password as the forum you visit three times a year.
If you suspect something, suspend first and investigate second. This family did exactly the right thing: call the provider in the morning, have the account suspended, change the password. That contained the damage before I was even at the door.
And if it has already happened?
Delete nothing. The threatening messages, the trash folder, the account settings — all of it is evidence. Report it to the police, and do it promptly: the provider’s login logs, which show who accessed the account and when, are only retained for a short period.
And have the devices checked before you put the account back into service. Not because there will necessarily be something to find — in this case there wasn’t. But because afterwards you want to know where you stand.
For this case I left the family with a written investigation report: methodology, devices examined, findings, and the limits of the examination. A document that can be handed to the police for the case file. To me that’s part of a job like this.
Do you have a similar suspicion? Give me a call on +49 2272 9774010. I’ll take a look and tell you honestly what’s going on.
Tom Commander, IT-Service-Commander, Bedburg (Germany)
A note on how this was written: this article is based on a real job and on my own findings on site. I used AI assistance for the drafting. All technical statements and recommendations were checked by me before publication.
