A compromised mailbox is an email account that has been taken over by an attacker and used as if it belonged to the legitimate owner. Once inside, the attacker can read messages, send convincing replies, delete evidence, and impersonate the user in ongoing conversations. Because email is often trusted for approvals, password resets, and document handling, control of a mailbox can give an attacker access to much more than messages.
This matters in cyber security because email is a common trust boundary. A compromised institutional mailbox can make malicious requests look routine, helping attackers bypass human review and procedural checks. In real attacks, it is used for business email compromise, fraudulent payment requests, internal phishing, and the theft of sensitive data or credentials. Defenses include multi-factor authentication, suspicious-login alerts, mailbox rule monitoring, phishing-resistant authentication, and independent verification for high-risk requests instead of trusting the sender name or domain alone.