Unexpected account activity
Password-reset messages, unfamiliar logins, sent messages you did not write, or changes to your recovery email can mean an account has been compromised.
+44 (0)1743 668200A single symptom does not always prove a cyber attack, but several unusual changes together are a strong reason to act quickly.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed September 2026.
Password-reset messages, unfamiliar logins, sent messages you did not write, or changes to your recovery email can mean an account has been compromised.
Persistent adverts, redirects, new toolbars or a changed homepage can be signs of adware or malicious browser extensions.
Unusual crashes, overheating, loud fans or heavy network activity may indicate hidden software running in the background.
Malware may disable antivirus protection, updates, backups or access to security websites.
Programs you do not recognise, new administrator accounts or files appearing unexpectedly should be investigated.
Unrecognised payments, credit alerts or unexpected multi-factor authentication prompts require immediate action.
Disconnect affected devices from the internet, do not enter important passwords on them, and use a different trusted device to secure your email and financial accounts. Then follow our recovery checklist.
See the next stepsThe National Cyber Security Centre provides additional response and recovery guidance for small organisations.
Recover now and secure your devices for the future.