The Moment You Realise Something Is Wrong
The discovery of a compromised account or device rarely happens the way security awareness training implies — with an obvious, dramatic notification. More often, it’s a subtle signal: a login notification from an unfamiliar location, an email in the sent folder that you didn’t write, a bank transaction you don’t recognise, a friend asking why you sent them a strange message, or the password reset email for an account you haven’t tried to reset. Recognising these signals as compromise indicators and responding promptly is the practice that limits damage.
The panic response to discovering a compromise — urgent, unplanned action driven by anxiety — often makes things worse by changing the wrong passwords in the wrong order, failing to preserve evidence that would help understand what happened, or rushing through steps that need to be done correctly. A calm, methodical response following a defined order is significantly more effective.
The First 30 Minutes: Containment
The immediate priority after discovering a compromise is containment — preventing the attacker from using the compromised access to do more damage, before you’ve dealt with what’s already happened. The containment actions depend on what was compromised: for a compromised account, change the password immediately on the compromised account and change the same password on any other accounts where it was reused. Enable MFA if it wasn’t already enabled. Sign out all other sessions (most account settings provide a ‘sign out of all other devices’ option).
For a device you suspect is compromised: disconnect it from the network (unplug the Ethernet, turn off Wi-Fi) to stop any malware from communicating with its command-and-control server or exfiltrating data. Don’t turn the device off (which may complicate forensic investigation if needed) unless the situation requires it. The isolation step limits what the malware can do next while you assess the situation.
Assessment: Understanding What Happened
After containment, understanding the scope of what happened determines the appropriate recovery response. For a compromised account: review the account’s recent activity (login history, sent messages, settings changes) to understand what the attacker did while they had access. Did they send messages to your contacts? Change recovery options? Access other accounts using this account’s recovery? The activity log provides the information needed to notify affected parties and identify other accounts that may be at risk.
For a compromised device: running a full antivirus scan provides a starting point for understanding what’s on the device, though modern malware may not be detected by signature scanning. The safer assumption when a device has been compromised: treat all credentials entered on the device as potentially compromised, change passwords for important accounts from a different device, and consider a full reinstall if the compromise was severe enough to suspect rootkit installation.
Recovery: Restoring the Situation
Recovery actions proceed in order of account criticality: primary email account first (the account that controls recovery for all others), then financial accounts, then other important accounts. For each account: change the password to a unique, strong password generated by a password manager, enable MFA if not already active, review and update recovery options (verify that recovery email and phone are under your control and not options the attacker may have changed), and review connected applications for any that were added by the attacker.
Recovery from device compromise: the level of remediation depends on the severity and type of compromise. For adware or low-level PUPs, removal tools and a full antivirus scan may be sufficient. For serious malware (ransomware, rootkits, sophisticated RATs), the only reliable recovery is wiping the device and reinstalling the operating system from a trusted source. Restoring from backup after reinstall — assuming the backup predates the compromise — returns the device to a known-good state.
Post-Incident: Preventing Recurrence
After recovering from a compromise, the post-incident step most people skip is the prevention analysis: how did this happen, and what specifically would have prevented it? The compromised account that had a reused password gets a password manager. The device that was compromised through a malicious installer establishes a policy of only downloading from official sources. The account taken over via SMS recovery enables a hardware security key instead.
Documenting what happened, what was done to recover, and what changes were made to prevent recurrence is useful both for future reference and for reporting to relevant parties (your financial institution if financial accounts were accessed, your organisation’s IT team if work accounts were involved, law enforcement if significant financial loss occurred). The documentation created during a calm post-incident review is also useful for helping others avoid the same compromise.