What would we do first if an employee account or email was hacked?

Contain the account quickly: reset credentials, revoke active sessions, enforce or reset MFA, and check for forwarding rules or suspicious changes. Preserve evidence, identify affected data or messages, and notify the right internal or external parties according to the incident plan.