Why are unknown events appearing in my calendar, and how do I stop them?
An unfamiliar event does not by itself prove your account was hacked. External invitations, subscriptions or authorized apps can add events. Avoid event links, identify the source, report the event where supported and review how new invitations are added.
Identify how the event arrived
An invitation sent to your address is different from a subscribed calendar, an event extracted from email or an app with calendar write access. Deleting the visible event without addressing its source may allow it to return.
Check the organizer and calendar name. Events sent by you that you do not recognize, unfamiliar applications or unknown sign-ins warrant an account security investigation, not just calendar cleanup.
Google Calendar with Gmail or Workspace
On the web, open Settings > Event settings > Add invitations to my calendar. Choose Only if the sender is known or When I respond to the invitation in email, depending on the available options. This limits automatic calendar additions but does not necessarily block the invitation email.
Report suspicious Google Calendar invitations as spam. Reporting removes the event and recurring instances, but events from other providers may not support that action. Do not accept an invitation just to remove it.
On a computer, you can block an organizer with a Google Account. Existing invitations remain until deleted, and blocking affects other Google services too. For non-Google accounts, use Gmail blocking. Known senders can also be compromised, so this setting reduces exposure rather than guaranteeing safety.
Outlook and Microsoft 365: version and event source matter
Use the reporting options available in your Outlook version. Microsoft added calendar-item reporting for Microsoft 365 subscriptions in specific classic Outlook builds. If the button is missing, ask your administrator to check the version and update channel.
Review events automatically extracted from email separately from meeting invitations. Disabling Events from email is not a universal block on malicious invitations. Business Microsoft 365 accounts also require a review of email policies and exceptions.
If events come from an unfamiliar subscribed calendar, remove that subscription after identifying the correct calendar. Do not delete a shared work calendar or reply to the suspicious organizer as a blocking method. Controls vary between Outlook.com, web Outlook, new Outlook and classic Outlook.
Policies for the whole organization
Combine email protection with invitation settings, subscription reviews and application permission checks. Do not block all external meetings without considering customers and suppliers.
Test with a legitimate invitation and make sure employees know how to report suspicious events. If they keep returning, Soportered can investigate the source and adjust protection without disrupting business scheduling.
If you already clicked or shared information
If you only opened a page, close it and report the incident. A click alone does not establish a compromise. If you downloaded or ran a file, ask your security contact to assess the device.
If you entered a password, change it through the official service and revoke sessions. If you authorized an app, remove its access and review permissions: changing a password alone may not revoke that authorization. Review MFA, recovery settings and recent activity with technical assistance.
Risks to review
- Do not call supposed support numbers or scan QR codes included in suspicious events.
- Turning off reminders does not remove the source.
- Avoid suspicious cancellation links and do not send replies to the attacker.
Safe recommendations
- Record the provider, app, organizer and affected calendar without exposing private information.
- Distinguish invitations, subscriptions and app-created events.
- Report where supported and limit automatic invitations in Google Calendar.
- Review subscriptions, authorized apps and unknown account activity.
- Confirm that legitimate business meetings still arrive after policy changes.
When to seek specialized help
- Invitations return, affect multiple people or are sent from your account.
- You entered credentials, authorized an application or ran a downloaded file.
- Ask Soportered for a review, explaining what happened and when without sharing passwords or codes.
Reference sources
These public sources provide general good-practice guidance. They do not replace an assessment of your environment.
Let’s stop suspicious calendar invitations
Soportered can investigate how events are reaching you and review email, calendar and application protections. Request a security review if you shared a password or authorized an unfamiliar app.
Request a security review