Learn
Playbook
A compromised Google Workspace account needs to be contained in a specific order: confirm the takeover using the audit logs and account security settings, reset credentials through an out-of-band channel, cut off every active session, OAuth token and app password, remove unauthorized forwarding or delegation, then check what the attacker touched before restoring the user. Doing these steps out of order, or skipping token revocation, lets a single hacked account turn into a wider Google Workspace security incident.
TL;DR
Do a quick check of the login and audit logs to confirm the compromise. If you see active misuse, suspend the account immediately and investigate after.
Containment order matters: reset the password out-of-band, reset the user’s sign-in cookies, revoke OAuth tokens and app passwords (cookie reset does not sign out some apps), remove forwarding and delegation, then decide on suspension (or suspend first if misuse is active).
Check for spread before declaring it over: shared files, Drive activity, new OAuth grants and other accounts the attacker may have targeted.
Know your escalation line: when the incident involves financial fraud, customer data or ransomware, it needs outside incident response and possibly regulatory notification, not just an admin reset.
A platform purpose-built for Google Workspace that shows app and OAuth permissions in one place shortens the investigation steps of this runbook.
About the Author: This article is written by the ShiftControl team. ShiftControl was built by ex-ExpressVPN operators and is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team.
How Do You Confirm a Google Workspace Account Is Actually Compromised?
A quick look at the login and audit logs is usually enough to confirm it. If the account is being actively misused, suspend first and come back to this list. Start in the Admin console rather than acting on a user’s self-report alone.
Specifically, check:
User log events (Reporting > Audit and investigation > User log events): look for sign-ins from unfamiliar IP addresses or countries, unusual login times or a burst of failed attempts followed by a success.
The user’s recovery email and phone number under their account settings: attackers frequently change these first to lock out the real owner and block Google’s own account-recovery prompts.
2-Step Verification status: if it was enabled and is now disabled, or a new phone/security key was added that the user doesn’t recognize, that’s a strong signal.
Security investigation tool: this lets you query User, OAuth, Drive and Gmail log events together, which is the fastest way to see whether unusual login activity coincided with unusual data activity. It is available in Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. On Business editions, use the audit and investigation page instead.
Once you’ve confirmed the takeover, move straight to containment.
What Is the Correct Order of Containment Steps?
Containment has an order because each step closes a different door the attacker can use, and doing them out of sequence leaves at least one door open while you’re closing the others. A sensible containment pattern for a compromised cloud email account is to cut off the credential, cut off the sessions, cut off the integrations, then clean up the mailbox configuration.
Reset the password through an out-of-band channel. Don’t email the new password to the compromised account. Set it directly in the Admin console (Users > select user > Reset password) and deliver it by phone or a separate, verified channel.
Reset the user’s sign-in cookies. In the Admin console, open the user, then go to Security > Sign-in cookies > Reset. This signs the user out of browser and mobile sessions, closing the window where a password reset alone wouldn’t help because the attacker’s session was still live. It does not sign them out of some apps, such as Gmail and Google Drive for desktop, which is why the next step matters.
Revoke third-party app tokens and app-specific passwords. Under the user’s Security settings, check connected apps and app passwords, and revoke anything unfamiliar. This step is frequently skipped, and it’s a common way a reset account gets re-compromised: an OAuth token can give an attacker persistent API access to Gmail or Drive data without needing the password at all.
Check and remove mail forwarding and delegation. Go to the user’s Gmail settings and check for forwarding addresses, filters that auto-forward or auto-delete and any mailbox delegates added. Attackers commonly set up silent forwarding rules as a way to keep reading mail even after you’ve reset credentials.
Check recovery email and phone again. Confirm these are back to values the real user controls. If the attacker changed them, Google’s own recovery flow will keep pointing to the attacker’s contact details until you fix this.
Consider suspending the account while you finish investigating, especially if you suspect ongoing activity. Suspension (Users > select user > Suspend) blocks login entirely without deleting data, giving you a safe pause button.
Suspension comes last here because a reset-and-revoke sequence keeps the user’s data and workflow intact if you’ve caught the problem early. Suspend first instead if you can’t reset credentials quickly, or if the attacker is actively sending mail or exfiltrating data. Suspension also resets the user’s sign-in cookies, so it cuts off browser and mobile sessions immediately. You can then work through the remaining steps without the clock running.
How Do You Check Whether the Compromise Spread?
A contained account isn’t the same as a resolved incident; containment stops new damage, but you still need to find out what already happened. This is where exfiltration risk gets concrete rather than theoretical.
Check these specific areas:
Files shared externally. Review Drive activity for the user and look for new “anyone with the link” shares or sharing with unfamiliar external addresses. Bulk Google Takeout exports are a known exfiltration pattern worth checking for specifically.
New OAuth app grants. An attacker with access to an account can authorize a malicious third-party app that retains API access even after you reset the password; this is why step 3 above has to happen before you consider the account clean.
Other accounts targeted. Check whether the compromised account sent emails to colleagues (a common pivot for business email compromise) or whether other users show the same suspicious login pattern around the same timeframe.
Admin role changes. If the compromised account had any elevated Workspace admin privileges, check the admin audit log for role or permission changes made during the compromise window.
Shadow IT discovery matters here too. If you don’t already have visibility into every third-party app with access to Workspace data, you’re investigating blind. An app-permission inventory, reviewed on a regular cadence rather than only during an incident, turns this step from a guess into a checklist.
How Do You Safely Restore the User?
Restore access only after the containment steps above are confirmed clean, not before. That rule prevents a repeat incident. Before lifting a suspension or handing back credentials:
Confirm no unfamiliar OAuth grants remain active.
Confirm forwarding rules and delegates are removed.
Re-enable 2-Step Verification and, where possible, move the user to a hardware security key or authenticator app rather than SMS.
Brief the user on what happened, in plain terms, so they recognize the same phishing or social-engineering vector next time.
When Does This Become an Incident That Needs Outside Help?
A single compromised account that you caught early and contained within a few steps is an operational response. It becomes a formal incident when any of the following apply: customer or financial data was confirmed accessed, the attacker pivoted to other accounts, ransomware or encryption activity appears anywhere in the environment or you’re unsure whether you’ve fully removed persistence (like a hidden OAuth grant you can’t identify). At that point you need ransomware incident response capability and possibly breach notification obligations, not just admin console steps.
This is also where a named incident response partner and your cyber insurance policy matter, so know both before you need them. ShiftControl includes cyber incident response (IR-1, via Blackpanda, an incident response and digital forensics firm) in every subscription, rather than as a paid add-on you have to negotiate for during an active breach.
How Does ShiftControl Help With This Process?
ShiftControl is purpose-built for Google Workspace. For this runbook, it shows every app and OAuth scope connected to your Workspace in one place, so the token review and shadow app discovery described above don’t depend on knowing which Admin console menus to check. The containment actions themselves, such as password resets, cookie resets and suspension, still happen in the Google Admin console. ShiftControl can also export app assignments and authorization history as audit evidence; certification and attestation decisions always sit with the auditor or certification body.
Frequently Asked Questions
My Google account was hacked. What’s the very first thing to do?
Reset the password through a channel the attacker doesn’t control (phone, in-person or the Admin console directly), then immediately reset the user’s sign-in cookies. Doing the reset alone, without the cookie reset, can leave an active session live.
Can an attacker still access data after I reset the password?
Yes, if they have an OAuth token or app-specific password, which can survive a password reset (some apps stop working on reset, but you shouldn’t count on it). This is why token revocation is a mandatory step, not optional.
Does suspending the account delete the user’s data?
No. Suspension blocks login but preserves mail, Drive files and settings, making it a safe way to pause an account during investigation.
How do I know if mail forwarding was set up without my knowledge?
Check the user’s Gmail settings for forwarding addresses and filters. Attackers often set up silent forwarding rules to keep reading mail after a password reset.
Do we need a separate identity provider if we only use Google Workspace?
Not necessarily. Google Workspace can act as the identity provider for SAML apps. ShiftControl adds visibility into the apps and OAuth scopes connected to your Workspace, plus Google Workspace access that is set up and removed automatically when people join, move or leave.
When should I involve an outside incident response firm?
When you find evidence of data exfiltration, lateral movement to other accounts, ransomware indicators or when you can’t confirm with confidence that you’ve removed every point of attacker access.
How long should containment take?
There’s no fixed industry figure for this; it depends on how quickly the compromise is detected and how many systems the attacker touched before discovery. Speed depends on detection and on having the audit log, OAuth grants and sharing activity easy to check, which is what Google’s audit and investigation tool is for.
About ShiftControl
ShiftControl is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team. Google Workspace access is set up and removed automatically when someone joins, moves or leaves, and everything else runs as a guided task list for the app owner. You can see every app and OAuth scope connected to your Workspace and track SaaS spend and renewals. You can also export app assignments and authorization history as audit evidence. Cyber incident response (IR-1, via Blackpanda) is included in every subscription. ShiftControl is SOC 2 Type 2 compliant, ISO 27001 certified and signed the CISA Secure by Design Pledge in 2024. Setup takes as little as 10 minutes with a Google Workspace admin sign-in.
Start a 14-day free trial, no credit card required.
References
Identify and secure compromised accounts | Support & troubleshooting | Google Workspace Help (knowledge.workspace.google.com)
About the audit and investigation tool (knowledge.workspace.google.com)
Sign a user out of a managed Google Account (knowledge.workspace.google.com)
