Incident Response Planning: What to Do When You Get Hacked

Recognizing the Signs of a Security Breach

The first step in responding to a hack is recognizing that one has occurred. Many people remain unaware that their accounts or devices have been compromised for weeks or even months, giving attackers ample time to cause damage. Learning to recognize the warning signs can dramatically reduce the impact of a breach.

Common indicators that your account has been compromised include unexpected password reset emails, login notifications from unfamiliar locations or devices, changes to your account settings that you did not make, messages sent from your accounts that you did not write, unfamiliar transactions on financial accounts, and friends or contacts reporting strange messages from you.

On your devices, signs of compromise include sudden slowness or unusual behavior, unexpected pop-ups or new programs appearing, your antivirus software being disabled without your action, webcam or microphone activating unexpectedly, and unusual network traffic or data usage.

If you receive a notification from a service that your data was involved in a breach, take it seriously even if you do not see immediate signs of compromise. Attackers often harvest credentials from breaches and use them weeks or months later.

Immediate Response Steps

Contain the Damage

Speed matters during a security incident. Your first priority is to stop the attacker from causing further harm. If your email account is compromised, it is the most critical account to secure because attackers can use it to reset passwords on all your other accounts.

Start by changing the password on your compromised account immediately. Use our password generator to create a strong, unique password that bears no resemblance to your previous one. If you cannot access the account because the attacker changed the password, use the account recovery process immediately.

Revoke Active Sessions

Most services allow you to view and terminate active sessions. After changing your password, go to your account's security settings and sign out of all other sessions. This forces the attacker to re-authenticate, which they cannot do if you have already changed the password.

Check Connected Apps and Permissions

Attackers often grant access to malicious third-party applications that maintain their access even after a password change. Review the list of apps and services connected to your account and revoke access for anything you do not recognize. This is especially important for email and social media accounts.

Enable Two-Factor Authentication

If two-factor authentication was not enabled before the breach, enable it immediately after regaining control of your account. If it was enabled and the attacker bypassed it, consider upgrading to a stronger form such as a hardware security key, which is resistant to phishing attacks.

Recovery Process

Assess the Scope

Determine which accounts and data may have been affected. If you reused the compromised password on other accounts, change those passwords immediately as well. Check your email for password reset requests or account creation confirmations you did not initiate, as attackers may have used your email to create accounts in your name.

Review financial accounts for unauthorized transactions. Check your credit report for new accounts you did not open. If sensitive personal information like your Social Security number was exposed, consider placing a fraud alert or credit freeze with the major credit bureaus.

Scan Your Devices

If you suspect your device is compromised, run a full antivirus scan with updated definitions. Consider using a bootable antivirus tool that scans your system before the operating system loads, which can detect rootkits and other persistent threats that hide from regular scans.

For severe compromises, the safest approach is to back up your important data to an external drive, factory reset your device, and reinstall your operating system from trusted media. Then restore only your data files, not applications or settings, which could be infected.

Document Everything

Keep a record of what happened, when you discovered it, what actions you took, and what was affected. This documentation is valuable if you need to file a police report, submit an insurance claim, or dispute fraudulent transactions. Take screenshots of suspicious activity, unfamiliar logins, and any communication from the attacker.

When to Contact Authorities

Report the incident to law enforcement if you have suffered financial loss, your identity has been stolen, the breach involved sensitive personal data, or you believe you know who is responsible. In many jurisdictions, identity theft and computer fraud are criminal offenses with dedicated enforcement units.

Contact your bank or credit card company immediately if financial accounts were affected. Most financial institutions have fraud departments that can freeze accounts, reverse unauthorized transactions, and issue new cards. Time-sensitive reporting deadlines often apply, so act quickly.

If the breach involved a work account or business data, notify your employer's IT security team immediately. Many organizations have incident response plans and legal obligations that require prompt reporting.

Preventing Future Incidents

Strengthen Your Password Practices

After recovering from an incident, rebuild your security foundation. Generate unique, strong passwords for every account using our password generator and store them in a reputable password manager. Never reuse passwords across accounts, as credential reuse is one of the primary ways a single breach cascades into multiple compromised accounts.

Implement Layered Security

Enable two-factor authentication on every account that supports it. Use a hardware security key for your most critical accounts. Keep your operating system, browser, and applications updated. Install and maintain reputable antivirus software.

Stay Vigilant

Monitor your accounts for suspicious activity. Consider using a breach notification service that alerts you when your email address appears in new data breaches. Regularly review your account security settings and connected applications. Use our text encryption tool when sharing sensitive information to ensure it remains protected in transit. Security is not a destination but an ongoing process of awareness and adaptation.