You discover you can’t log into your email. Or friends are messaging you, saying they received strange requests for money from you. Or funds have disappeared from your card without your involvement. The first reaction in such a situation is panic, and that’s natural, but it’s precisely in the first hours after discovering a hack that correct, swift actions can significantly limit the scale of the damage.

Let’s break down a specific, step-by-step plan — what to do first, and what can wait.

Step 1 (First 5 Minutes): Don’t Panic and Assess the Scale

Before acting, it’s crucial to quickly understand exactly what happened: was it one specific account that was compromised, or were data compromised that grant access to several services (for example, a hacked email used to reset passwords for other accounts)?

Check: can you still log into the compromised account, or has access been completely lost? This determines the subsequent sequence of actions — if you still have access, you need to act immediately before it’s completely taken away.

Step 2 (If Account Access Still Exists): Immediately Change Your Password

If you can still log into the account, this is a critical window of opportunity. Immediately change your password to a new, unique one that has not been used on any other service before.

After changing the password, check the active sessions or connected devices section (in most services, this is found in security settings) and terminate all sessions except the current one. This will forcibly log out the attacker, even if they were already inside the account.

Step 3: Enable Two-Factor Authentication

If it wasn’t enabled before, this is a top priority. If it was already enabled but the attacker somehow gained access, check if a stranger’s phone number or two-factor authentication method is linked to the account, and if necessary, reconfigure it using an authenticator app instead of SMS, which are less secure against interception.

Step 4: Check and Restore Account Contact Information

Attackers often change the linked email or phone number first to solidify control over the account and make it difficult for the owner to regain access. Check the personal data section — if the recovery email or phone has been changed to someone else’s, revert to your own contact details.

Step 5: If Account Access is Completely Lost — Initiate Recovery Procedure

Most major services (Google, email providers, social networks) have access recovery forms for hacking incidents. Typically, you’ll need to confirm account ownership via alternative data — a recovery email, phone number, answers to security questions, or a photo of an ID document in some cases.

Be prepared for the recovery process to take anywhere from a few hours to several days, especially if the attacker has already changed all contact details. Don’t give up after the first failure — most services have alternative procedures for complex cases.

Step 6: Investigate How the Breach Occurred

Understanding the cause of the hack is critically important to prevent recurrence. Possible sources: using the same password on multiple sites (one of them was breached, and the password was then used for others), clicking a phishing link, malware infection on a device, or physical access to an unlocked device.

Check via haveibeenpwned.com to see if your email has appeared in any known data breaches recently — this can help clarify the source of the problem.

Step 7: Change Passwords on All Related Services

If the same or a similar password was used on multiple sites, you must change passwords everywhere, not just on the compromised service. Pay special attention to email (other accounts are often recovered through it), banking apps, and accounts linked to payment data.

This is an ideal moment to switch to a password manager and generate unique passwords for each service — you can read more about this in one of our previous articles on the risks of using one password for everything.

Step 8: Notify Your Bank if Financial Data is Affected

If an account linked to payment data has been compromised, or if there’s reason to suspect an attacker has access to your banking details, immediately contact your bank using their official number (not a number received in a suspicious message). You can temporarily block your card until the situation is clarified, which will prevent further unauthorized transactions.

Carefully check your transaction history for the past few weeks for any operations you didn’t make.

Step 9: Warn Contacts if a Messenger or Social Network is Compromised

If a messenger or social media account is hacked, scammers often send messages from your name to friends and acquaintances, asking for money transfers or containing phishing links. As quickly as possible, warn your contacts about the hack through an alternative communication channel — call them, message them on another app — so they don’t fall victim to fraud in your name.

Step 10: Scan Your Device for Malware

If there’s suspicion that a compromised device was the cause of the hack (and not just a password leak on another service), run a full antivirus scan. Additionally, it’s worth using specialized utilities for finding malware — Malwarebytes is good at catching what regular antiviruses sometimes miss.

Step 11 (Within 24 Hours): File a Report for Significant Damage

If the hack resulted in financial damage — theft of money, a loan taken out in your name, serious property damage — you should file a police report. Even if the chances of a thorough investigation of a specific case are low, an official report creates a documented trail that can be important for further legal procedures, including disputes with the bank over fund recovery.

Step 12: Document Everything That Happened

Take screenshots of all suspicious activities, messages, and account setting changes you noticed. This documentation is useful for a police report, communication with your bank, and further analysis of how the hack occurred.

24-Hour Checklist

✅ Change password if access is still available
✅ Terminate all active sessions
✅ Enable or reconfigure two-factor authentication
✅ Restore correct account contact details
✅ Initiate access recovery if lost
✅ Change passwords on related services
✅ Notify bank if financial data is at risk
✅ Warn contacts via an alternative channel
✅ Scan device for malware
✅ Preserve evidence of the incident

Conclusion

An account hack is a stressful situation, but not a catastrophe without a solution. Most damage can be minimized or even prevented through quick, methodical actions in the first hours after discovering the problem. The main thing is to act in order, not skip steps due to panic, and use the incident as an opportunity to strengthen overall digital security for the future, not just to solve the immediate problem.