Cannot log in
A password has changed, recovery details look different or the account says it does not recognise you.
Get Remote Support
Symptoms of Being Hacked
A single symptom does not always prove a cyber attack, but several unusual changes together are a strong reason to act quickly.
Quick answer
One unusual change may be a fault, but two or more signs—such as unfamiliar sign-ins, password resets, strange messages or missing files—mean you should act carefully. Use a trusted device, protect important accounts and follow the recovery checklist.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed 6 November 2026.
Common signs your device or account may be hacked
One sign on its own may be a glitch. Two or more signs together may indicate a hack, scam or account compromise. If money, email or business systems are involved, act carefully before deleting anything or changing passwords from the affected device.
1 / 16
Two or more signs? Treat it seriously and follow the recovery checklist.
If you notice these symptoms
Disconnect affected devices from the internet, do not enter important passwords on them, and use a different trusted device to secure your email and financial accounts. Then continue to the full checklist.
View the Been Hacked Recovery ChecklistNot sure whether you have a virus, malware or have been hacked?
The symptoms can look similar. Malware may cause pop-ups, browser redirects, slow performance, unfamiliar software or security warnings. Some incidents may also put passwords, accounts or personal information at risk.
I think I have a virus or malware
Use the general recovery checklist to contain the problem, protect accounts and check the device safely.
Choose this routeI am getting fake virus pop-ups
Do not use the number in the pop-up. Follow the safe first-response steps instead.
Choose this routeMy browser is redirecting or has changed
Start with the recovery checklist before removing unfamiliar browser extensions or entering passwords.
Choose this routeSomeone remotely accessed my computer
End the session, disconnect the device if needed and secure important accounts from a trusted device.
Choose this routeMy email account may be hacked
Check your email recovery route, sign-ins, rules and forwarding settings.
Choose this routeMy Microsoft 365 account may be compromised
Choose the personal or business Microsoft recovery steps that match your account.
Choose this routeMy files have been encrypted
Get ransomware-specific guidance before wiping, restoring or paying anyone.
Choose this routeI am not sure what happened
Work through the main recovery checklist in a safe order.
Choose this routeNeed help from a person?
If you are unsure which route applies, start with the recovery checklist. It puts the urgent actions in a safe order.
Start the recovery checklistIndependent guidance
The UK National Cyber Security Centre provides additional response and recovery guidance for small organisations.
Don’t Wait Until It Gets Worse.
Recover now and secure your devices for the future.