Realising your account or device has been compromised is a horrible feeling. But the actions you take in the first few hours can make a huge difference to how much damage is done. Here's a clear, step-by-step guide to follow if you think you've been hacked.
Step 1: Don't Panic — But Act Fast
Panic leads to mistakes. Take a breath, then work through these steps methodically. The sooner you act, the better — but rushing and making errors can make things worse.
Step 2: Disconnect from the Internet
If you suspect your device has been compromised by malware, disconnect it from the internet immediately. Turn off Wi-Fi and unplug any ethernet cables. This stops the malware from communicating with external servers, spreading to other devices on your network, or exfiltrating more of your data.
Step 3: Identify What Was Compromised
Was it a single account (email, social media, banking)? Or do you think your device itself has been infected? The answer determines your next steps. Check for:
- Emails you didn't send in your sent folder
- Password reset emails you didn't request
- Unfamiliar logins in your account activity
- Transactions you don't recognise
- Strange programmes or processes running on your device
Step 4: Change Your Passwords — From a Safe Device
If your email or other accounts have been compromised, change your passwords immediately — but do this from a different, unaffected device. If you use the same device that may be infected, the attacker could capture your new passwords too.
Start with your email account, as this is the master key to most other accounts. Then change passwords for banking, social media, and any other important services.
Step 5: Enable Two-Factor Authentication
Once you've regained control of your accounts, enable two-factor authentication (2FA) on all of them. This means even if someone gets your password again, they still can't get in without your second verification step.
Step 6: Alert Your Bank
If there's any chance your financial information was compromised, contact your bank immediately. They can monitor your account for suspicious activity, freeze your card if necessary, and reverse fraudulent transactions in many cases.
Step 7: Check for Malware
Run a full scan with your antivirus software. If you don't have antivirus installed, or if your existing software may have been disabled by the attacker, seek professional help before reconnecting to the internet.
Step 8: Report It
Report the incident to Action Fraud (the UK's national fraud and cybercrime reporting centre) at actionfraud.police.uk or by calling 0300 123 2040. If your business data was involved, you may also have an obligation to report it to the ICO within 72 hours under GDPR.
Step 9: Get Professional Help
If you're not confident you've fully secured your device and accounts, get professional help. Attempting to clean up a compromised system without the right knowledge can leave hidden threats in place.
At The IT Workshop, our Virus & Malware Removal and Cyber Security Assessment services can help you recover from an attack and put measures in place to prevent it happening again.
How to Protect Yourself Going Forward
- Use a unique, strong password for every account
- Enable 2FA on all important accounts
- Keep your software and operating system updated
- Be suspicious of unexpected emails, even from people you know
- Back up your data regularly