Email compromise means an attacker has gained unauthorized access to an email account. That access may come from stolen passwords, phishing, session hijacking, or abuse of a weak recovery process. Once inside, the mailbox becomes a foothold: it can expose internal conversations, password reset links, invoices, attachments, and contact lists that help the intruder learn the business and plan the next step.
In cyber attacks, compromised email is often used to impersonate employees, forward messages to hidden accounts, and harvest credentials from ongoing conversations. In defense, it is a high-priority identity event, not just a mail issue. Security teams should investigate suspicious logins, revoke active sessions, enforce strong authentication, review forwarding rules, and monitor for unusual mailbox activity. In banking and other sensitive environments, one compromised inbox can open the door to broader unauthorized access.