My email account was hacked, what legal steps should I take beyond just recovering it?

Question

My email got hacked and the attacker changed the password and possibly accessed sensitive personal or financial information stored in it. What I am unsure about is the procedure — where the application goes, what it costs, and how long email hacked matters usually take. A plain explanation of the steps, in order, would help more than a general answer.

MyVakeel Legal Desk · Accepted Answer

The law that applies to email hacked here is Information Technology Act, 2000 – Section 43, Information Technology Act, 2000 – Section 66 and Information Technology Act, 2000 – Section 72. The detail below matters, because Information Technology Act, 2000 – Section 43 draws the line differently depending on what your documents show.

Beyond recovering access through the provider's account-recovery process, the unauthorised access itself is a civil wrong under Section 43 IT Act entitling you to compensation, and a criminal offence under Section 66 if done dishonestly, punishable with up to 3 years imprisonment.

If the hacked email contained sensitive personal data (bank statements, ID copies) that has now potentially been accessed and disclosed, this also implicates Section 72 IT Act (breach of confidentiality) against the hacker once identified.

Immediately check and revoke access of any third-party apps/devices linked to your email account, since attackers often add forwarding rules or backup email addresses to maintain silent access even after you reset the password.

Notify your bank and any service where the compromised email is registered as a recovery contact, since the attacker can use it to reset passwords elsewhere via the compromised inbox.

File a complaint at cybercrime.gov.in with the timeline of events, and request the email provider's law-enforcement support portal (Google/Microsoft have dedicated portals) to preserve logs for the investigation before they are purged.

What this means for you: 1) Recover the account and immediately change the password and enable two-factor authentication; 2) Check and remove unfamiliar recovery emails, forwarding rules and linked devices; 3) Notify your bank and other linked services of the compromise; 4) File a complaint at cybercrime.gov.in citing Sections 43/66/72 IT Act.

Where the facts are disputed, what usually decides a email hacked matter is the paper trail — dated complaints, acknowledgments and written replies under Information Technology Act, 2000 – Section 43. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.