Data breaches and hacked accounts: what to do first
After a data breach alert or a hacked account, the order of your actions matters more than their speed. Secure your main email account first, because it can reset everything else, then the accounts that hold money or customer data, then the rest. A breach alert usually means a password or an address leaked somewhere; a hacked account means someone is already inside.
What to do after a data breach or a hacked account
Something has gone wrong, or might have: a service tells you your data was in a breach, a monitoring tool says your email is “on the dark web,” or you can no longer sign in to an account that worked yesterday. This guide is the recovery step of our plan for securing your business accounts, and its first rule comes from the UK’s NCSC, which explains that whoever controls your email can reset all your other account passwords. Whatever happened, your main email account is where you start.
An alert or a takeover?
The two situations look alike in a panic, but they call for different responses.
| Breach or dark web alert | Hacked account | |
|---|---|---|
| What happened | Your email address, a password, or other data leaked from a service you used | Someone has signed in to your account, or locked you out |
| Typical signs | An email from the service, a password manager warning, a monitoring alert | Password no longer works, recovery email or phone changed, messages you did not send, unknown sign-ins |
| Urgency | Act within the day | Act now |
| First step | Change the leaked password everywhere you used it, and turn on a second factor | Recover the account through the provider’s official process, starting with your email |
The order of response
- Your main email account. Regain access, then check its forwarding rules and filters before anything else: the NCSC’s guide to recovering a hacked account explains that a hidden forwarding rule sends the attacker a copy of every password reset. Then change the password, turn on a second factor, and check the recovery email and phone number.
- Your password manager, if you use one: change its master password if there is any chance it was exposed.
- Accounts that hold money: bank, payments, accounting. Call your bank if you see anything unusual.
- Accounts that speak for your business: website, social media pages, domain registrar.
- Everything else, starting with any account that shared the leaked password.
- Tell the people who need to know: your team, clients who may have received fake messages from you, and, if you lost money, the authorities in your country.
Recovery takes time, by design
Providers make account recovery slow on purpose, because the same process that lets you back in could let an attacker in. According to their help pages, Google says recovery without any other sign-in method can take three to five business days; Microsoft imposes a 30-day wait when all security info is replaced, and says it cannot help if two-step verification is on with no alternate method; Apple says recovery may take several days or longer. Backup codes and a second sign-in method, prepared in advance, are what turn days into minutes.
Keep a record as you go
Write down what happened while it is fresh: the date and time you noticed, the messages or alerts you received, the settings that had changed, and every reference number you are given by your bank, the provider, or the police. Take screenshots before you fix anything, because some evidence disappears once you change a setting. This record helps your bank, your insurer if you have cyber cover, and the authorities, and it saves you from repeating the story from memory in every call.
Your email was in a data breach
A breach notice or a search on a breach-checking service tells you that an address or a password leaked from a service you used. Our guide to what a breach alert means and what to change explains how to read it and what to do in the next hour.
“Your email is on the dark web”
Credit agencies, security suites, and some browsers now send these alerts. The page on making sense of dark web alerts explains what they monitor, what an alert proves, and when to act.
A hacked Google or Gmail account
If you can no longer sign in, or your recovery details were changed, follow the recovery steps for a hijacked Google account, including the Gmail settings attackers often leave behind.
A hacked Outlook or Microsoft account
Microsoft has its own recovery form and its own waiting periods. Our guide to taking back a Microsoft account walks through them in order.
A hacked Facebook page or Instagram account
For a business, losing a social media page can mean losing its audience and its ad account. See how to recover a business’s Facebook and Instagram accounts.
Identity theft
If someone opens accounts, borrows, or files in your name, the steps depend on your country. The FTC’s IdentityTheft.gov builds a recovery plan in the US; our page on the first steps after identity theft covers the US, the UK, Canada, and Australia.
More on securing your accounts
Most of the damage described here is avoidable. A password manager with a different password for every account, a second factor or a passkey, and the habit of checking unexpected requests close the doors these attacks use, and protecting a small team’s logins extends them to everyone you work with.