What to Do When a School Google Workspace Account Is Compromised
Contain access quickly while preserving the evidence needed to understand mail, identity, OAuth, forwarding, delegation, and recovery changes.
What this guide helps you do
Leave with a workable next step.
- Contain sessions and tokens as well as the password.
- Inspect Gmail rules, forwarding, delegation, recovery, and administrative activity.
- Restore access through a known-safe device and trusted communication channel.
Contain unauthorized access
- Record report time, user, symptoms, suspicious messages, and actions already taken
- Suspend the account when continued access creates material risk
- Reset credentials through the district’s trusted process
- Revoke active sessions, app passwords, and unauthorized OAuth tokens
- Protect linked recovery addresses and high-value systems
- Notify finance or payroll immediately if payment or deposit information may be affected
Preserve the timeline
Record sign-ins, source locations, devices, session events, password and recovery changes, OAuth grants, Gmail messages, forwarding, filters, delegation, routing, file access, and administrative actions. Preserve message IDs and timestamps before bulk removal.
Privacy boundary: collect the evidence needed for the authorized incident purpose and handle student and employee information under district policy.
Inspect Gmail persistence and misuse
- Forwarding addresses and POP/IMAP access
- Filters that archive, delete, label, or forward security messages
- Mailbox delegates and send-as addresses
- Suspicious drafts, sent mail, trash, and deleted items
- Messages sent to internal groups, personal contacts, vendors, and finance staff
- Related messages still present in other district mailboxes
Restore access deliberately
- 1Use a known-safe device
Address malware, malicious extensions, and unsafe recovery paths before issuing new credentials.
- 2Rebuild trusted access
Set a unique credential, enroll strong MFA, verify recovery information, and approve only required applications.
- 3Monitor the return
Watch sign-ins, messages, rules, tokens, and user reports through a defined heightened-monitoring period.
Close the incident with owners
Document entry point, affected data and people, messages sent, business changes attempted, containment time, communication, and unresolved questions. Assign dates to improvements such as phishing-resistant MFA, alert routing, OAuth review, mail investigation, or staff process changes.
K12First Guard connects sender, content, link, report, and campaign context so the district can review related mail and response evidence.
Sources and further reading
Primary guidance and related K12First material used to review this resource.
This resource provides general operational guidance. Apply changes through your district’s authorized security, privacy, legal, and change-management processes.
