After logging into your cPanel account, you notice that one or more Email accounts have gone missing.
When accessing the main Email account interface, the Email account list is either incomplete or empty.
If the Email account list is empty or missing users, and you are sure they exist, look at the
/home/$user/etc/shadow and file
/home/$user/etc/passwd. There may be some iteration of a backup, and if so, you can move this back to
If there is no backup, you will need to edit the
shadow and sometimes the
passwd file and copy one of the existing entries to recreate the entries for any missing Email account.
After this has been done, if the Email accounts do not appear in the interface, you will need to move the Email accounts JSON file located in
Finally, reset the password for each of the users that were recreated. To do this from the cPanel interface, please review How to reset your Email password through the cPanel interface. For the commandline, please review How To Reset Email User Passwords via the command line.
If this continues to happen, the account is likely compromised. You will need to restore the account from a clean backup or to clean the account. It's best to consult with a security administrator to ensure the site is fully cleaned. The following article may also be helpful.