To take action : Start now; duration depends on the incident · Depending on your devices and accounts
I've been hacked. What do I do right now?
Choose first actions based on what is actually compromised.
PatchYourself · Last editorial revision : · Sources
Fictional example: an everyday situation
Chris receives a sign-in alert and finds an unfamiliar forwarding rule in his email. From another trusted device, he follows the provider’s official help to regain control and check persistent access.
Start with your situation
An alert or unusual behavior does not alone prove a compromise. Check the facts, but do not wait if an unauthorized payment or access is confirmed.
Suspicious payment or banking fraud: contact your bank immediately using the number on your card or in its official app. It will advise on appropriate measures. Do not use a number supplied by a suspicious message.
If you suspect malware, use another trusted device to secure accounts. For work devices or accounts, contact your organization’s support before changing or erasing evidence.
What to do now
Step 1: Check account access
Open the service through its app or known address. If locked out, use its official recovery process. Avoid account-recovery ads and people promising guaranteed results for payment.
Google’s compromised-account process is linked in the sources. For another provider, start at its official help center.
Step 2: Secure affected accounts
Protect your main email if it recovers other accounts. Replace exposed passwords and any reused elsewhere. Check recovery details and enable a passkey or additional sign-in protection where available.
Step 3: Remove unfamiliar access
Review devices and active sessions, connected apps, newly added passkeys and app passwords. In email, also review forwarding rules and filters. Sign out unfamiliar sessions and revoke unauthorized access following provider instructions.
Changing a password does not necessarily end every session or remove an added forwarding rule.
Step 4: Keep useful records
Note dates, alerts, messages, transactions and actions taken. Keep useful screenshots without republishing secrets. Warn affected contacts if your account sent fraudulent requests.
Step 5: Address the device and get help
If infection is suspected, limit the affected device’s connections and follow official or professional guidance. Do not restore data onto a still-compromised system. Do not rush into a reset before considering evidence and data you need to retain.
In France, Cybermalveillance.gouv.fr offers incident-based guidance. Reporting and support processes depend on country and type of harm.
Go further
After regaining control
Review security settings again, monitor alerts and prepare backups. If data was copied, regaining account access does not undo disclosure.
Prepare for next time
Keep recovery methods accessible away from the main device and your bank’s official contact channel at hand. The email guide and checklist help organize these actions.
Sources and verification
References used for this revision. Menus and offers can change; consult the provider’s help for your version.