What should an HOA board do when a board email account is hacked?

By OurHOA · General information · Revised October 30, 2026

What an HOA board does when a board email account is hacked: lock it down, remove forwarding rules, stop payments, warn owners and check breach notice duties.

Part of the HOA board handbook: running the board.

The short answer

Treat the first hour as an emergency and the next month as a records problem. Lock the intruder out from a clean device, then look for what they left behind, because a stolen board mailbox is rarely just read. Thieves add forwarding rules, set filters that hide replies, and send payment requests to the treasurer or to vendors from your real address. Call the association's bank before anyone pays anything that came through that mailbox in the last few weeks. Warn owners and vendors through a different channel. Then search the mailbox with the attorney and decide whether owner data inside it turns this into a data breach with a notice deadline. Our guide on protecting HOA bank accounts from fraud covers the payment controls, and our guide on responding to a data breach of owner information covers notice letters. This guide covers the account takeover itself. Rules vary by state and by your governing documents, and this guide is education, not legal advice.

The first hour: get the intruder out

Work from a different computer or phone than the one the director normally uses. The FTC tells people with a hacked account to update their security software and run a scan before anything else. A new password typed on an infected laptop can be stolen again the same afternoon. If you can't sign in, use the provider's recovery process. Google and Microsoft both publish one, and the board's account inventory should say which provider the association uses and who holds the admin login. Once you are in, change the password to a long one used nowhere else. If the association runs Microsoft 365 with an admin account, Microsoft recommends disabling the hacked user during the investigation rather than only resetting the password. Sign out every session and remove devices you don't recognize. Turn on two-step sign-in if it was off, and delete any sign-in method the director didn't set up. Check that the recovery phone and recovery email belong to the association or the current director. A thief who planted their own recovery number can take the account back next week. Don't send the new password to anyone by email. Microsoft's guidance makes this point directly, because the attacker may still be reading the mailbox. Pass it by phone or through the board's password manager. In Microsoft 365, app passwords used by older mail programs survive a password reset, so delete them and make new ones.

Look for what the intruder changed

Before anyone deletes anything, take dated screenshots of each setting below. The bank, the insurer and the police may ask for them. Forwarding and filters come first. Google says to check automatic forwarding and remove any filters you didn't create. Microsoft lists rules that forward mail to unknown addresses or move messages into the Notes, Junk Email or RSS Subscriptions folders, where nobody looks. A thief waiting for the treasurer's reply about a wire hides that reply this way, so the real owner of the mailbox never sees the conversation. Next, read the sent and deleted folders for the whole period the account may have been open, not just today. Look for messages to the treasurer, the bank, the manager, vendors and owners, and for replies that were opened and then deleted. Then check connected apps. Google's list of apps with access and Microsoft's app consent list show programs that can read mail without a password. Remove any the board didn't add. Look at the signature and display name too. Microsoft notes that attackers sometimes plant fake banking details in a signature. Write down the earliest date of suspicious activity you find. That date sets the window for everything after it: which payments to recheck, which owners may have received a fake message, and which records the intruder could have opened.

Stop the money and warn people

Call the bank's fraud line the same day, even if nothing seems to have gone out. Ask it to flag new payees, recent changes to account contacts, and any wire or ACH request since the earliest date you found. If money already left, the FBI's Internet Crime Complaint Center says to contact the originating bank as soon as the fraud is recognized, ask for a recall or reversal, and file a complaint at ic3.gov with the banking fields filled in. IC3 says quick action may reduce or eliminate the loss, so make this call before anything else on the list. Pull every invoice and payment instruction that came through the hacked mailbox in the window and confirm each one by phone, at a number the association had on file before. If the intruder wrote to the landscaper or the pool company, they may now hold fake bank details that look like they came from you. Call them too. Warn owners through a channel the thief doesn't control, such as a text alert, a portal post or a notice at the mail kiosk. Keep it short: "The [Association] board email address [address] was used by an unauthorized person between [date] and [date]. If you got a message from that address during that time asking you to pay dues to a new account, sign in through a link, or send personal information, do not act on it, and call [name] at [phone]. The association has not changed how dues are paid. The account is secured." Only include the sentence about dues if it is true. Send a similar note to vendors, and tell the insurance agent the same week. Crime and cyber policies often require prompt notice of a loss, so read yours for the deadline.

Does a hacked mailbox mean a breach notice

Sometimes. State breach laws turn on what personal information the intruder could reach, and a board inbox often holds plenty: W-9s with sole-proprietor vendors' Social Security numbers, driver's license copies sent for pool passes or gate remotes, ACH forms, and accommodation letters with medical details. Search the mailbox and its attachments for those items across the window you found. Texas Business and Commerce Code section 521.002 defines sensitive personal information as a name combined with a Social Security number, a driver's license or government ID number, or a financial account or card number with the code that opens it, plus health information. It does not list logins. Section 521.053 requires notice no later than 60 days after the breach is determined. Florida section 501.171 names an association as a covered entity, requires notice within 30 days, and also counts a username or email address paired with a password or security answer that opens an online account. Colorado section 6-1-716 has the same login category and the same 30-day limit. So in Florida and Colorado, owner portal passwords sitting in the inbox, or a director's stolen login, can be protected information on their own. Ask the attorney how that applies to you. If the search finds protected data, the clock may already be running, so move straight to the steps in our data breach guide. If it finds nothing, write a short memo saying what was searched, by whom and when. That memo is what the board will want if an owner or the insurer asks later.

A one-week timeline

Hour 0: whoever spots the problem calls the president and treasurer. Lock the account from a clean device. Day 1: screenshot the settings, remove the forwarding and filters, call the bank's fraud line, warn owners and vendors, and tell the insurance agent. Days 2 and 3: one director, not the whole board, reads the sent and deleted folders for the window. They list every payment instruction and every message or attachment with personal data, and the treasurer rechecks each payment by phone. Days 4 and 5: the attorney reviews the list and says whether notice is required and by when. Day 7: board meeting, or action as your bylaws allow. A sample motion: "Move to accept the incident summary dated [date], to require two-step sign-in on every association account by [date], and to authorize up to $[amount] for legal review and any required notices." Keep owner data out of the minutes. Record that the incident happened, what was decided and who owns the follow-up.

Mistakes boards make

Deleting the account in a panic. Keep it. The bank and the FBI may need the messages and their headers, and the association's own records live in it. Changing the password and stopping there. If the forwarding rule stays, the intruder keeps reading every message that arrives. Using the hacked account to talk about the hack, or replying to a suspicious message to ask whether it was real. Call instead. Telling owners "no information was taken" before anyone has searched the mailbox. Letting one director handle it quietly out of embarrassment. Tell the full board in writing the same day. Phishing catches careful people, and a director who reports it fast has done the job right. Leaving a former director's phone number as the recovery method, or a personal Gmail as the recovery address. Our guide on HOA board email and shared accounts covers role mailboxes, password managers and handovers, which prevent most of this. When the dust settles, add the provider's recovery steps, the name of whoever holds the admin login and the bank's fraud number to a one-page sheet every director can find.

Sources

These guides are general education for HOA boards and residents, not legal, tax, or financial advice. Rules vary by state and by your community's governing documents - check with a professional for your situation.

More on board & governance

Or browse all hoa boards & governance guides.