Getting hacked is stressful. It can feel personal, urgent, and confusing all at once. You may see a strange login alert,\nfind messages you did not send, lose access to an account, notice money missing, or hear from friends that they received\nsuspicious links from you.
\nThe most important thing is to avoid panic-driven decisions. Attackers often rely on speed, confusion, and pressure.\nYour goal is to slow the situation down, contain the damage, recover control, and then remove the weaknesses that made\nthe compromise possible.
\nThis guide walks through the practical steps to take if a personal account, business account, device, or online service\nhas been hacked.
\nIf there is any chance your employer, customer, or another organization may be affected, notify the appropriate IT or\nsecurity team immediately. Do not wait until you have complete proof. This includes cases where the compromised device was\nused for work, enrolled as a bring-your-own-device (BYOD) device, used to access company email, used for single sign-on,\nor logged in to a company password manager, VPN, admin panel, source code repository, cloud console, or file-sharing\nservice.
\nThis should happen before you try to investigate everything yourself. The organization may need to revoke sessions,\nrotate credentials, check logs, isolate affected systems, or disable access while the incident is still unfolding.
\nDelaying this notification can make the damage worse and may expose you to disciplinary action or liability if the\norganization suffers losses that could have been limited by prompt reporting. If no business services, devices, accounts,\nor data could be affected, continue with the personal recovery steps below.
\nIf you think your computer or phone may be infected, do not use that same device to reset passwords or log in to\nimportant accounts. Malware can record new passwords, steal session cookies, capture screenshots, or intercept recovery\ncodes.
\nUse a device you trust, such as:
\nIf you do not have access to a clean device, disconnect the suspected device from the internet and focus on getting help\nbefore entering new credentials.
\nYour email account is often the key to everything else. If an attacker controls your email, they can reset passwords for\nbanking, shopping, cloud storage, social media, developer platforms, and business tools.
\nStart with your main email account and check the following:
\nPay special attention to mailbox rules. Attackers sometimes create filters that hide security alerts, forward invoices,\nor silently copy password reset messages to another address.
\nAfter securing email, move to the accounts that can cause the most damage. Do not waste the first critical minutes on\nlow-value accounts while the attacker still has access to banking, cloud storage, or administrator tools.
\nPrioritize accounts in this order:
\nEvery new password should be unique. If you reuse the same new password across several accounts, one remaining weak\npoint can compromise everything again.
\nChanging a password is important, but it may not remove an attacker who is already logged in. Many services keep active\nsessions alive after a password change unless you explicitly revoke them.
\nLook for settings such as:
\nRemove anything you do not recognize. For business or developer accounts, rotate API tokens, deployment keys, SSH keys,\nwebhooks, and service account credentials that may have been exposed.
\nMulti-factor authentication, often called MFA or 2FA, can stop many account takeover attempts even when a password is\nstolen. If MFA was not enabled before, enable it now on your important accounts.
\nPrefer stronger options where available:
\nSMS-based codes are better than having no second factor, but they are weaker than app-based or hardware-backed options.\nPhone numbers can be transferred through SIM swap attacks, intercepted in some situations, or abused through weak account\nrecovery processes.
\nWhen you enable MFA, generate backup codes and store them somewhere safe. Otherwise, losing a phone or security key can\nturn recovery into a separate emergency.
\nIf the hacked account touches money, identity documents, invoices, customer data, or tax information, assume the attacker\nmay have copied useful details even if you regain access quickly.
\nCheck the following:
\nContact your bank or payment provider immediately if you see suspicious activity. In many cases, faster reporting improves\nyour chance of reversing fraudulent transactions or limiting liability.
\nIt is natural to want to clean up quickly, but deleting messages, logs, or files too early can make investigation harder.\nBefore removing suspicious items, preserve basic evidence. Do this before wiping or reinstalling a device, especially if\nmoney, company data, customer data, ransomware, or legal obligations may be involved.
\nUseful evidence includes:
\nThis information can help support teams, banks, law enforcement, insurers, internal IT teams, or incident responders\nunderstand what happened.
\nIf the laptop or desktop allows it, consider removing the original drive and installing a new hard disk or SSD for the\nfresh operating system installation. That gives you a clean system to work from while preserving the original disk in case\nit is needed for investigation. If you are dealing with a business incident, ask IT or an incident responder before\nchanging disks or powering the device on again.
\nIf the compromise may have started from malware, a malicious attachment, a fake browser extension, pirated software, or\nunknown remote-access tools, account recovery alone is not enough. The device itself may no longer be trustworthy. An\nattacker could have installed persistence mechanisms, modified system settings, captured session cookies, or left behind\nsoftware that steals the new credentials as soon as you enter them.
\nIn that situation, the safer default is not to \"clean\" the device manually. The safer default is to preserve any needed\nevidence first, back up only the data you truly need, wipe the device, and install the operating system fresh.
\nImportant precautions:
\nFor a high-risk compromise, especially ransomware, business email compromise, administrator account takeover, or suspected\ndata theft, consider professional incident response help before wiping systems. In business cases, evidence may be needed\nfor investigation, insurance, legal obligations, or customer notification.
\nIf attackers used your account to send messages, invoices, links, or files, warn the people who may have received them.\nKeep the warning short and specific.
\nFor example:
\n\n\nMy account was compromised. Please do not open links, attachments, payment requests, or shared files sent from me\nbetween [time] and [time]. I have regained access and am investigating.
\n
For businesses, notification may also be a legal or contractual requirement. If customer data, employee data, payment\ninformation, health information, or confidential client material may have been exposed, involve legal, compliance, and\nsecurity teams early.
\nNot every hacked social account requires a police report, but some incidents should be reported. This is especially true\nfor financial fraud, identity theft, ransomware, business email compromise, stolen customer data, or threats involving\npersonal safety.
\nUseful reporting channels may include:
\nReporting also creates a record. That record can matter later if fraudulent activity continues or if you need to prove\nthat you acted quickly.
\nFor organizations, a hacked account is rarely just an account problem. It may be the first visible sign of a broader\nincident. A compromised email inbox can expose customer conversations. A stolen administrator password can lead to data\nexfiltration. A leaked deployment key can affect production systems.
\nBusiness response should include:
\nIf the incident involves regulated data, customer data, ransomware, production infrastructure, or privileged access, get\nprofessional help early. Waiting too long can make containment and evidence collection harder.
\nSome well-intentioned actions make recovery harder or create new risk.
\nAvoid these mistakes:
\nOnce the immediate situation is under control, spend time strengthening your setup. Most account compromises are not\ncaused by advanced hacking. They come from reused passwords, phishing, weak recovery options, malware, exposed devices,\nor old access that nobody removed.
\nA practical hardening checklist:
\nSecurity does not have to be perfect to be much better. A few consistent habits can remove the easiest attack paths and\nlimit the damage if something goes wrong again.
\nGetting hacked is not always a sign that you did something foolish. Attackers target people and businesses constantly,\nand even careful users can be tricked by a convincing phishing page, a reused password from an old breach, or a device\nthat was compromised quietly.
\nWhat matters most is the response: secure email first, change passwords from a trusted device, revoke sessions, enable\nstrong MFA, check financial risk, preserve evidence, and notify anyone who could be affected. After that, improve the\nsystems and habits that make the next attack less likely to succeed.
","frontmatter":{"date":"June 29, 2026","slug":"what-to-do-if-you-get-hacked","title":"What to Do If You Get Hacked","description":"A practical step-by-step guide for containing damage, recovering accounts, protecting money and data, and reducing the chance of getting hacked again.","author":"Sascha Pfeiffer","featuredImage":null}}},"pageContext":{"slug":"what-to-do-if-you-get-hacked","lang":"en","langPathPrefix":""}},"staticQueryHashes":["2149092236","3128451518","3192060438"]}