In the Google Workspace Admin, under the user -> security tab, you can kill all the cookies. Also check app registrations in that page.
For each hacked user, check their Gmail filters. Also check the blocked addresses and unblock them all.
Make sure 2FA is enabled for users.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article