Cannot log in
A password has changed, recovery details look different or the account says it does not recognise you.
Been Hacked Recovery Checklist
Follow this checklist in order: identify what happened, stop further damage, save evidence, secure email and money, recover accounts safely, then protect against further activity.
1How do I know if I've been hacked?
One sign on its own may be a glitch. Two or more signs together may indicate a hack, scam or account compromise. If money, email or business systems are involved, act carefully before deleting anything or changing passwords from the affected device.
Unexpected MFA alerts
You receive password reset, sign-in or MFA prompts that you did not request.
Messages sent from your account
Friends, customers or colleagues say they received emails, texts or social messages from you.
Money or invoices look wrong
Orders, refunds, supplier bank details, payment requests or account activity do not look right.
Files have changed
Files are missing, renamed, encrypted or changed in a way you cannot explain.
Unknown devices or apps
You see sign-ins, connected apps, browser extensions or devices that you do not recognise.
Rules or forwarding look wrong
Mailbox rules, forwarding addresses, delegated access or sent items have changed without your knowledge.
Your site or domain has changed
Website content, DNS records, domain settings or admin users look different from what you expect.
Someone is pressuring you
A caller, message or pop-up asks you to install software, share codes, pay money or act immediately.
Two or more signs? Treat it seriously and move to the recovery steps below.
2Identify what has happened
Identify the risk before you act
Before changing passwords or resetting devices, work out what looks affected. This helps you choose the safest recovery path and avoid destroying useful evidence.
Risks to individuals
- Is money moving or could bank details be exposed?
- Is the main email account still under your control?
- Which account, device or service looks affected?
- Was this a personal account, a work account or both?
- Has customer, staff or business data possibly been exposed?
Risks for business
- Could customer, staff or supplier data have been exposed?
- Are staff reporting unusual emails, MFA prompts or account changes?
- Have files, shared drives, backups or business systems been changed or lost?
- Could invoices, payments or supplier bank details have been tampered with?
- Is there a chance of ransomware, data theft or a wider Microsoft 365 compromise?
3Follow the right recovery route
Home Users
Personal email, bank, phone, computer, Microsoft, Google, Apple, shopping or social accounts.
- A
Stop contact and disconnect
End suspicious calls, chats or remote sessions. Disconnect affected devices from the internet.
- B
Reclaim your email account
Use a clean trusted device to secure your main email or logon account first.
- C
Scan your devices
Run trusted security scans on affected computers, phones or tablets.
- D
Update your software
Use supported, maintained software. Older apps and systems may leave devices open to further attacks.
- E
Change the main password
Change the password for your main email or logon account only at this stage.
- F
Turn on MFA
Add multi-factor authentication before checking deeper account settings.
- G
Check email rules and logins
Look for hidden rules, forwarding, unknown devices and sign-ins. Note the earliest suspicious login date.
- H
Start an event log
Record changes, alerts, dates, times and anything suspicious you remove.
- I
Check other accounts
Check banking, shopping, social and cloud accounts. Update passwords where you reused the same password.
- J
Check money and messages
Look for payments, orders, refunds, emails or posts you did not make.
- K
Report financial loss
If money is involved, contact your bank and report the scam to the correct authorities.
- L
Watch for follow-up scams
Be careful of fake recovery services, urgent payment demands and new support calls.
Business Users
Work email, Microsoft 365, Google Workspace, staff devices, websites, customer data or shared systems.
- A
Find your cyber insurance
Locate your cyber insurance policy and check the incident reporting instructions.
- B
Find your policies
Check your data protection, incident response, backup and acceptable use policies.
- C
Obtain professional support
Some cyber insurance policies include expert incident response help. Use it early if available.
- D
Confirm the breach scope
Work out what systems, accounts, devices, users and data may be affected.
- E
Check personal data
Decide whether customer, staff or supplier personal data may be involved.
- F
Start the 72-hour clock
If the breach is reportable, the ICO expects reporting without undue delay and within 72 hours.
- G
Notify key contacts
Contact IT support, insurer, legal adviser, bank or senior decision maker where needed.
- H
Preserve evidence
Keep logs, screenshots, emails, alerts, affected users, timelines and actions taken.
4Next steps
For everyone
- If you suspect a scam, treat it as real until you have checked it safely.
- You are more likely to be targeted again if you have already been a victim.
- Do not hide a breach. Report it to the right organisation and keep evidence.
- Check exposed email addresses at Have I Been Pwned.
- Check known compromised passwords at Pwned Passwords before reusing anything.
- Never reuse passwords. Each account password should be unique.
- Use unique passwords. KeePass is a good low-cost offline password manager.
- Turn on MFA for email, banking, Microsoft, Google, Apple, social and cloud accounts.
- Review account recovery details, trusted devices, forwarding rules and connected apps.
- Update Windows, macOS, iOS, Android, browsers and key apps.
- Check unknown callers with Who Called. Do not call back until you have checked the number and found the official contact route.
- Warn close contacts if your email, social media or messaging account may have been used to contact them.
Home users
- Check banking, shopping, social media and cloud storage again over the next few days.
- Create a new email address for banking and professional services. A fresh address is less likely to already be on scam lists.
- Keep screenshots, messages and reference numbers in case you need to report fraud later.
- Run trusted security scans, such as Sophos online scanner where suitable.
Businesses
- Create or update your disaster recovery document.
- Create a business continuity plan for working through an incident.
- Review your acceptable usage policy for staff, devices, email and cloud systems.
- Create a breach reporting system so staff know what to report and who to tell.
- Test your backups and record the restore result.
Helpful contacts
Help assessing, securing and recovering business systems.
Fraud, scams and cyber crime reports in England, Wales and Northern Ireland.
UK government-backed scheme that helps organisations protect against common cyber attacks.
Check whether an email address or password has appeared in known data breaches.
Personal data breach guidance and reporting for UK organisations.
Free offline password manager for keeping unique passwords in an encrypted database.
Microsoft security guidance and built-in Windows protection tools.
Serious organised cyber crime information. Call 999 in an emergency or 101 for non-emergency police support.
UK National Cyber Security Centre advice for individuals, families and small organisations.
Free second-opinion malware scanner for Windows devices where a trusted scan is appropriate.
Prepare before a breach and recover in the right order
Use these PDFs to record the information you may need before something goes wrong, then follow the same staged recovery process used on this page.
Home user recovery checklist
For personal email, phones, computers, banking, shopping, social media, Microsoft, Google and Apple accounts.
Download Home User PDFBusiness recovery checklist
For Microsoft 365, Google Workspace, staff accounts, websites, shared systems, customer data and incident records.
Download Business PDFNeed support after working through the checklist?
If money, customer data, Microsoft 365, a website, domain name or several devices are involved, get practical help before deleting evidence or rebuilding systems.
Need guided help?
Contact your trusted support provider. IT Life-Raft customers can download the Support Toolkit. Confirm the technician's identity before allowing remote access.
Disclaimer
This guide gives general information only. It does not guarantee recovery of accounts, files, data or money. Every incident is different.