If you've had an email through that is trying to get you to respond or help someone with buying something, you've not been hacked. This is known as Phishing.
Every email address is like a postal address. Once someone knows your email address, they can send you a message from anywhere in the world, as the councils email addresses are available on the website they can be scraped by criminals to use in phishing scams.
Whilst your email system blocks the vast majority of these messages before you ever see them, no spam filter is perfect, so occasionally one gets through to your inbox. Protecting your mailbox from these emails means that it's likely that the emails you do want to receive will not get delivered so it's a fine balance. Think of it as keeping you house door locked, but being able to open it when you want to let someone through; if you board it up, no one can get in.
Receiving a phishing email actually shows that your email system is working:
- Most malicious emails were blocked automatically.
- The suspicious one was delivered because it looked convincing enough to evade the filters.
- You recognised it as suspicious and did not interact with it.
These the the signs that you have been hacked:
- Emails being sent from your account that you didn't send.
- Your password no longer working.
- Unexpected login notifications from unfamiliar locations or devices.
- New inbox rules or email forwarding that you didn't create.
- Missing or deleted emails.
- Unauthorised changes to your account settings.
- Colleagues receiving strange emails that genuinely came from your account.
If none of these things have happened, then simply receiving phishing emails does not suggest that your organisation has been hacked.