How to Recover a Hacked Google Workspace Account
A hacked Google Workspace account follows a different recovery sequence than a hacked Microsoft 365 account — different admin console, different log locations, different session revocation steps. If your business runs on Google Workspace and an account has been compromised, here’s the sequence that actually locks the attacker out rather than just changing the password and hoping.
Step 1: Lock Out Active Sessions Immediately
Changing the password alone does NOT end an attacker’s existing session — Google (like most providers) keeps sessions active until explicitly revoked. From the Admin console, go to the user’s account and use “Sign out of all sessions,” which forces immediate re-authentication everywhere, including any session the attacker is actively using right now.
Step 2: Reset the Password and Enforce MFA
Set a new, strong password and, if not already enabled, enforce multi-factor authentication on the account immediately — see our MFA guide if it isn’t already standard across your organization — an account compromised once without MFA is at significantly higher risk of repeat compromise through the same credential-stuffing or phishing vector that worked the first time.
Also Check: Recovery Info and 2-Step Verification Methods
Before moving on, check the account’s recovery email, recovery phone number, and registered 2-Step Verification methods (backup codes, added security keys, added authenticator app) for anything the attacker added or changed — this is one of the most common persistence mechanisms in a real account takeover, letting an attacker regain access later even after you’ve reset the password and killed sessions. Revert anything unfamiliar before considering the account secured.
Step 3: Audit and Remove Malicious Forwarding Rules and Filters
| Where to check | What attackers commonly add |
|---|---|
| Gmail forwarding settings | Auto-forward to an external address to continue reading mail post-recovery |
| Gmail filters | Rules that auto-delete or archive security alerts from Google |
| Delegated access | Attacker-added delegate accounts with ongoing mailbox access |
| Connected third-party apps | OAuth app grants added during the compromise window |
Step 4: Revoke Third-Party App and OAuth Access
Review “Connected apps & sites” (or the admin-level “App access control” for Workspace) and revoke anything unfamiliar, especially apps granted during the suspected compromise window. This is a common persistence mechanism — an attacker who’s locked out of direct account access can sometimes retain data access through an OAuth grant they made while they had control.
Step 5: Check Admin Console Audit Logs
The Admin console’s audit log (under Reporting) shows login attempts, location/IP data, and account changes — review this for the full compromise window to understand what the attacker actually accessed, not just that a login happened. This matters for breach notification obligations too: what data the attacker touched determines whether you have a reportable incident.
Step 6: Check for Lateral Movement to Shared Drives
If the compromised account had access to shared drives or sensitive shared documents, review sharing activity logs for that window — a compromised account is often used to exfiltrate or alter shared files, not just read the mailbox. Revoke any sharing links created during the compromise window that you didn’t authorize.
If You Run Both Google Workspace and Microsoft 365
The console names and specific menu paths differ, but the underlying sequence — kill sessions, reset credentials, enforce MFA, audit forwarding/OAuth, check logs — is the same across both platforms. See our hacked Microsoft 365 recovery guide for the Microsoft-specific console steps if you’re managing a mixed environment.
Preventing a Repeat
Once the account is secured, review your broader Workspace security settings — our Microsoft 365 and Google Workspace backup guide covers making sure you have an independent backup that survives this kind of account-level compromise, since a sophisticated attacker can sometimes delete mail and files before you catch them.
Bottom Line
Password resets alone don’t end a Google Workspace compromise — kill active sessions first, then work through forwarding rules, OAuth grants, and audit logs before considering the account actually clean.
Official sources: Google Workspace Admin Help — Compromised Accounts, CISA — Cyber Threats and Advisories.
