Did You Just Get Hacked? Here’s What to Do in the Next 10 Minutes

Upon discovering an account is compromised, it’s natural to feel afraid. The first thing to do if you get hacked is to pause, take a deep breath, then disconnect the impacted device. Don’t overreact, reuse old passwords, or keep using the affected device. Any of these actions can play into the hacker's hands.

It’s an understandable knee-jerk reaction to change your passwords, but you may inadvertently notify the hacker that you’re aware of the hack and play into their hands.

Tony Sabaj, an engineering director at a cybersecurity firm, stressed that disconnecting your impacted device is key. “Remove the laptop from your Wi-Fi network or disconnect it from your network. Remove your cell phone from Wi-Fi and turn on airplane mode.” The latter is particularly important if you suspect your mobile device has been compromised.

The reasoning behind disconnecting devices is simple: You want to eliminate the hacker's access to your device. That’s an important first step in reclaiming your digital life.

Having a recovery plan is vital after being hacked. The FTC says to start with your primary email account, as many Americans use that to manage much of their online life.

Scott Doerr, who has 26 years of experience in executive cybersecurity, IT, and risk leadership, explains why. “An attacker who controls your email may be able to reset passwords for banking, social media, shopping, cloud storage, and other accounts,” noted Doerr. Don’t do it from the compromised device. “...Force sign-out of all existing sessions, review recovery email addresses and phone numbers, remove unknown devices or applications, and enable strong multifactor authentication (MFA),” explained Doerr.

That still may not be enough. You may also want to promptly protect your phone. “The most important thing to focus on is securing your phone number, your phone carrier account, and making sure that no one else can receive your texts,” argued Dustin Sandlin, a cybersecurity expert who offers online tech support services.

It seems odd, but the reasoning is clear. “If a criminal convinces your carrier to move your number to their SIM card or another provider…they may receive your calls and texts, including login codes for email, banking, and other accounts,” suggested Sandlin. If you can, protect your primary account and phone simultaneously to protect accounts after being hacked.

Securing your accounts after a hack involves more than protecting your primary account and resetting passwords. After that, it’s time to remove the hacker. Assuming the hacker is still signed in through their device, they can keep wreaking havoc.

“If they already have an authenticated session or have established another way back into the account, changing the password may not remove their access,” noted Doerr. Visiting your account’s security settings can help you remove the attacker. Remove anything that doesn’t look right, such as trusted devices, connected apps, or active sessions to protect yourself. This includes verifying your recovery email addresses and phone numbers, according to the FTC. If something doesn’t look right, remove it.

Don’t stop there, though. You want to verify that the hacker hasn’t set up email forwards as part of their activity. “Make sure the attacker hasn't established persistence through things such as email forwarding rules,” argued Doerr. Doing this is essential to removing the hacker. Protecting your money and other high-risk accounts is next.

After securing your online accounts, secure anything financial. This includes bank or brokerage accounts, credit cards, payment apps, or anything else tied to your identity.

Many financial institutions offer fraud prevention, but not all do. If yours doesn’t, contact them via a known phone number to alert them to the hack. They may direct you to create a new strong password, set up MFA, or some other form of authentication to secure the account.

Review account activity to determine if any transactions have taken place. Don’t just look for large withdrawals. Some hackers may make smaller transactions to see whether they can access the account. Freezing your credit may also be prudent if you can't verify its safety, according to the State of New York.  

Finally, review your email and social media accounts to identify if the hacker has used them to spread their reach. Sandlin explains why. “... It's not just your account but the contact list inside of your accounts that the hackers are after…this is how hacking usually spreads, through our very own contacts, friends and family,” argued Sandlin. Doing this can help stop the cycle.