After a Hack: Immediate Steps

When you discover that an account or a device has been compromised, the first emotion is often panic or shame. Neither helps. What helps is a clear sequence of actions, carried out in the right order. In this lesson you will learn that sequence: how to regain control, limit the spread, protect your contacts and recover, step by step, with the specific cases of a hacked account, an infected device and a fraudulent payment.

Keep this lesson handy. In a real incident you may not want to read a whole chapter, so we finish with a short checklist that you can print and add to your Security Notebook.

The principles of a good response

• Contain first. Stop the attacker's access before doing anything else.
• Work from a clean device. If your computer or phone may be infected, do not change passwords from it, because the attacker could capture the new ones. Use another device you trust, such as a family member's phone, to start with.
• Prioritize. Start with the accounts that can unlock everything else (email), and those with money (banking).
• Write down what happens. Note times, messages and actions. It helps for reports and complaints later.
• Keep evidence. Take screenshots of suspicious messages and alerts before deleting anything.

Case 1: an online account has been hacked

1. Try to sign in. If you still can, go to step 2. If not, use the service's official "account recovery" process, and contact its support through its official website.
2. Change the password immediately, with a long unique passphrase generated by your password manager, from a clean device.
3. Sign out of all sessions and devices. Most services have "sign out everywhere" in the security settings. This kicks the attacker out even if they hold a valid session.
4. Check and fix the account settings. Look at the recovery email and phone number, forwarding rules, filters, connected apps, delegated access and payment methods. Remove anything you did not set up. Attackers often leave a way to return.
5. Enable or strengthen two-step verification, ideally with a passkey, a security key or an authenticator app, and generate new recovery codes.
6. Change the password everywhere you reused it. Start with email and banking. This is why unique passwords matter: one hack should not become ten.
7. Secure your email first if it was the one hacked. A compromised mailbox lets the attacker reset your other accounts, so after cleaning it up, review other important accounts for signs of takeover.
8. Warn your contacts. Send a short message by another channel: "My account was hacked. Do not click on the links I sent and do not send money." This prevents your friends and family from becoming victims.
9. Review what the attacker may have seen. Messages, documents, saved cards, addresses. This tells you what other risks to prepare for, such as targeted phishing.
10. Report to the service through its official reporting tool.

Case 2: a device is (or may be) infected

1. Disconnect it from the network: switch off Wi-Fi, unplug the cable and turn off Bluetooth. This limits further damage, and stops the device from encrypting files stored on shared drives or from sending data out.
2. Disconnect external drives and backups to protect them from ransomware.
3. Use another, clean device to change your important passwords (email, banking, cloud storage), and sign out of all sessions.
4. Scan the device with an up-to-date security tool, preferably in the safest mode available, and remove what it detects. If you are not able to trust the result, go further.
5. If in doubt, rebuild. The most reliable cleanup for a serious infection is to back up essential files (scanning them first), erase the device completely and reinstall the system from a trusted source. On a phone, this is a factory reset. It feels drastic but it leaves nothing behind.
6. Restore data from a backup that predates the infection (lesson 3.3), not from the infected machine.
7. Update everything, then change passwords again once the device is confirmed clean.
8. Find out how it happened: an attachment, a download, an old system? Fix the cause, so that it does not recur.

Case 3: a fraudulent payment or stolen card details

1. Contact your bank immediately, using the number on your card or on the official site. Ask to block the card and to dispute the transactions. Do this quickly, since delays can affect your rights.
2. Request a new card and update stored payment details on services where you use it.
3. Check your accounts for other suspicious transactions, including small ones.
4. If you made a transfer to a scammer, contact your bank at once and ask them to attempt to recall it. The earlier you act, the better the chances, although success is not guaranteed.
5. Do not send more money to "recover" the first payment. Fake recovery services target scam victims.
6. Keep all evidence: messages, emails, receipts, the account number, the website and the dates.

The rules about who bears the loss for unauthorized payments depend on the country and the circumstances, and on whether you were careless or not. In general, reporting promptly puts you in the best position.

Case 4: a stolen identity, documents or phone

• Lost or stolen phone: lock or erase it remotely, ask your operator to block the SIM, change the passwords of key accounts and file a report with the police.
• Stolen identity document: declare the loss or theft to the competent authorities, and follow the national procedure for replacement. In France you can report the loss at a police station or online, and the authorities explain how to protect yourself against identity theft.
• Suspected identity theft: check your credit and financial records, alert your bank, and keep a record of every step. Consider a fraud alert or credit freeze where your country offers them.
• Data leak at a company you deal with: change the password, watch for phishing that uses the leaked details, and consider asking the company what data was affected (lesson 5.1).

What not to do

• Do not pay ransoms or blackmailers. It encourages them, and does not guarantee anything.
• Do not answer or negotiate with the attacker, or reveal more information.
• Do not ignore it in the hope that it will go away.
• Do not use unverified "recovery" services found through a search or social media; they are often scams that target victims.
• Do not try to "hack back". It is illegal and risky.
• Do not blame yourself. Attackers are professionals. Learn and move on.

Your emergency checklist

Here is a short version that you can put in your notebook:

1. Breathe. Use a clean device.
2. Disconnect the infected device from the network.
3. Change the email password, then banking, then the rest. Sign out everywhere.
4. Check settings: forwarding, recovery information, connected apps.
5. Strengthen two-step verification.
6. Call the bank if money or cards are involved.
7. Warn your contacts.
8. Keep evidence, then report (next lesson).
9. Restore from a clean backup if needed.

Your turn

Exercise. Your friend Sam tells you that their main email account sends strange messages, and that they cannot sign in any more. Sam uses the same password for email, a shopping site and a cloud drive. Write the order of actions you would advise.

See a solution

1. Use a clean device to start the account recovery process on the official website of the email provider, with the recovery phone or email.
2. Once access is regained: set a new long unique passphrase, sign out of all sessions and check the forwarding rules, filters, connected apps and recovery information.
3. Enable two-step verification, with new recovery codes.
4. Change the password of the shopping site and the cloud drive immediately, using unique passwords, and check their activity, saved cards and shared links.
5. Check other accounts that use this email for password resets, starting with banking.
6. Warn contacts by another channel not to click on the earlier links.
7. Scan the devices Sam used, as the password may have been stolen by malware, and report the incident.

Add to your Security Notebook

Under "7. Incident response", copy the emergency checklist above, adapted to your situation: the phone number of your bank's card-blocking service, the name of a trusted person with a clean device, and the location of your recovery codes.

Once the situation is under control, there are official places where you can report, file a complaint and get help. That is the subject of the next lesson.