Don't Panic — But Move Fast
Getting hacked is frightening. Your first instinct might be to freeze, or to start clicking around trying to figure out what happened. Resist both.
The first 24 hours are critical. The actions you take — and the order you take them — can mean the difference between a bad day and a catastrophic loss.
Here's exactly what to do.
Step 1: Identify What Was Compromised
Before you can respond, you need to know what you're dealing with. Common scenarios:
- Email account taken over — you've been locked out, or you see emails you didn't send
- Website hacked — defaced, down, showing strange content, or flagged by Google as dangerous
- Social media account stolen — you can't log in, or posts are appearing without you
- Financial fraud — unauthorized charges or transfers
- Data breach — customer or employee information exposed
Different situations require different responses. Take two minutes to identify which one (or which combination) you're facing before you act.
Step 2: Contain the Damage
Change passwords immediately — starting with your email account. If your email is compromised, assume any account tied to that email is at risk, because your email is how you reset every other password.
Sign out of all active sessions — most email services and social platforms have a "sign out everywhere" or "active sessions" option in security settings. Use it.
Revoke app access — check which third-party apps have access to compromised accounts and revoke anything you don't recognize.
Alert your bank — if there's any chance financial information was involved, call your bank immediately. They can monitor for suspicious activity or freeze your accounts.
Step 3: Secure Your Recovery Path
Attackers often lock in their access by changing your recovery email and phone number before you notice. Check and restore:
- Recovery email address
- Recovery phone number
- Security questions
- Backup codes for 2FA
Also check for any email forwarding rules that may have been set up quietly. A common trick is to forward copies of all your emails to an attacker's address, so they keep reading your inbox even after you've regained access.
Step 4: Figure Out How It Happened
You need to close the door, not just kick out the attacker. Common entry points:
- Weak or reused password — change all accounts that used the same password
- Phishing — you clicked a link and entered credentials on a fake site
- Compromised third-party app — a connected app had a breach
- Malware on your computer — if you suspect this, scan your devices immediately (Malwarebytes is free and reliable)
If you can't identify the entry point, assume your password was compromised and change passwords across all important accounts.
Step 5: Communicate Appropriately
If customer data was involved, you may have legal obligations to notify affected individuals. Requirements vary by state, but 72 hours is a common window. Contact a lawyer before sending any breach notification if you're unsure what's required.
If your website was hacked, Google may flag it as dangerous. Once you've cleaned it up, use Google Search Console to request a malware review.
Brief any employees on what happened and what steps they should take.
Step 6: Prevent the Next One
Once the immediate crisis is handled:
- Enable two-factor authentication on all important accounts
- Use a password manager to generate and store unique passwords for every account
- Set up login alerts where available — most services can email you when someone logs in from a new device
- Consider credit monitoring if personal financial information was exposed
Getting hacked once is misfortune. Getting hacked twice the same way is preventable.