Minute-by-minute recovery guide for hacked accounts

Cybercriminals go after people's personal information on all kinds of online platforms, including WhatsApp, Instagram, LinkedIn, YouTube and Spotify, as well as financial apps. No online account is safe. The first obstacle to be overcome when an account is hacked; It is panic. A clear emergency plan will help you overcome this obstacle quickly. Cyber ​​security company ESET explained in detail what needs to be done in the first 15 minutes to recover a hacked account.

If one of your accounts is attacked, your first priority should be not to lose your calm and to take action immediately. The faster you act, the more you can disrupt the attacker's work. Once they gain access, their first move may be to change the recovery email address, add their own backup code, or create secret email forwarding rules so they can monitor your account even after you change your password. The steps you take in the first 15 minutes without panic will help you a lot.

Stop the damage (0–2 minutes) 

Check if you still have access to the account. If you have access, consider how the breach occurred. Use a different device instead of the device where you first noticed a problem.  If you can't access the account at all, go to the platform's support pages and start the account recovery process. If financial accounts are involved, call your bank or credit card provider and specifically request that the transactions be blocked and the account flagged for monitoring. 

If you suspect malware, disconnect the device from the internet. An active malware attack may be exfiltrating data or communicating with the attacker in real time; so you need to stop this.  If your device has up-to-date security software, run a full scan. But don't wait for the scan to complete; start the scan and continue with the next steps from a different device. If you don't have security software and are online, ESET's online scanner can help. Meanwhile, ESET's link checker can instantly flag certain malicious URLs. The important thing is that you don't delete anything yet. Online services may request suspicious messages and other possible evidence during the reporting and account recovery process.

Secure access (minutes 3–6) 

If the attack has affected your email account, pay attention to the email forwarding rules that attackers often silently configure; These rules ensure that copies of incoming emails reach attackers even after they regain control. Most email clients list active forwarding rules in the settings – check these and remove anything you haven't set yourself. Also check the account's recovery settings – backup email address, recovery phone number and backup codes. Change the password from a device you think is trustworthy. Passwords should be strong and unique – not a variation of a password you have used before or elsewhere. If possible, enable two-factor authentication (2FA), even if the service doesn't prompt you to do so. 

Disposable 2FA recovery codes can save you if you lose access to the device where regular 2FA codes are usually sent. Store recovery codes in a hard copy in a safe place, preferably offline. Losing these codes may permanently prevent you from accessing your account. Finally, close all active sessions and revoke access to connected third-party services. 

Checking process  (minute 7–10) 

If you have used the same password on other platforms, change it everywhere. The credential stuffing process, where attackers automatically test the stolen username and password combination across a number of platforms, is largely automated and takes seconds. If the credentials worked once, they will be tried again. Whenever possible, check login history and recent activity to detect unrecognized logins. Also check for anything that seems strange: Contact information you haven't changed, sent messages you don't recognize, and unfamiliar purchases or transactions. It is necessary to pay special attention to the e-mail account.Checking your inbox can often be the equivalent of checking most of your entire digital identity.

Cleaning (minutes 11–13) 

Review the list of installed software and remove anything you didn't install or recognize. Also take a look at web browser extensions because they often go unnoticed. Check that your operating system and other software are running the latest version because malware often exploits vulnerabilities for which patches are available. 

Warning and notification (14–15 minutes and later) 

Let your family and friends know what happened. An attacker who steals your login information can further spread the "infection" by impersonating your identity; For example, it can send malicious links to your friends and persuade them to transfer money. The sooner they are informed, the lower the risk of exposure. 

Also, if you haven't done so yet, report the incident to the platform. Your financial accounts may have been affected and if you haven't called your bank yet, do so immediately (so don't just report online). Learn specifically about blocking transactions and adjusting activity tracking settings. When your security software completes the scan, review the findings and act on the software's recommendations.

What you need to do to reduce the risk of account takeover

• Use a strong and unique password or passphrase for each online account. 
• A password manager solves the above practical problem by creating and storing a different, strong password for each service. 
• Enable 2FA. Even if the password is stolen, a solid 2FA can prevent an attacker from going any further.
• Keep software updated. Updates fix vulnerabilities that attackers know about and are actively exploiting. 
• Be wary of phishing, a common method used by attackers to steal login information. 
• Consider ditching passwords and enabling passkeys when offered for seamless, secure access to your accounts.
• Use a security solution. Reputable, multi-layered security software plays a big role in keeping you safe, including from phishing attempts.
• Use an identity protection service that notifies you of newly discovered personal information in the dark corners of the internet so you can take timely action.