I noticed unusual account activity and login attempts I don’t recognize, so I’m worried I’ve been hacked. What immediate cybersecurity steps should I take to secure my accounts, devices, passwords, and personal information?
Don’t click links in the security alerts or start changing passwords from a device you think may be infected. Open the account’s official app or type the site address yourself, preferably on another trusted device. Save screenshots of suspicious logins, messages, transactions, and timestamps before removing anything.
Secure your primary email account first because it can reset most of your other accounts. Change its password to a new, unique one, sign out every active session, remove unfamiliar devices, and check recovery email addresses, phone numbers, forwarding rules, filters, and connected apps. Then repeat that process for banking, payment, cloud storage, social media, and shopping accounts. Turn on multifactor authentication with an authenticator app or security key when available. Save the backup codes somewhere offline.
Assume any reused password is exposed. Change those accounts individually rather than making minor variations of the same password. A password manager makes this much easier. Check whether the attacker added their own MFA method or changed account recovery details, since changing the password alone may not lock them out.
Update your phone and computer, uninstall anything unfamiliar, remove suspicious browser extensions, and run a full malware scan. If you installed software after following a scammer’s instructions or gave someone remote access, disconnect that device from the internet and consider a full reset. Don’t restore questionable programs from the same backup afterward.
Contact your bank immediately about unauthorized transactions and replace affected cards. If sensitive identity information may have been exposed, freeze your credit with all three major US credit bureaus and review your credit reports. Warn contacts if your email or social account sent messages, and tell them not to open attachments or send money. Keep monitoring accounts for a while because misuse does not always happen immediately.
Don’t assume a password change will protect you if someone has taken over your phone number. Contact your mobile carrier, add a strong account PIN and port-out lock, check for unfamiliar SIM or eSIM changes, and reset your voicemail PIN. If your phone suddenly loses service, treat that as urgent because an attacker may be intercepting text-message login codes.
If any suspicious activity involves a work or school account, contact their IT or security team before wiping the device or deleting messages. They can revoke login tokens, preserve logs, check whether other users were targeted, and tell you whether the computer needs to be handed over. Quietly “fixing” it yourself can remove evidence they need.
For personal accounts, work from a device you trust and separate confirmed facts from scary-looking notifications. Open the real account directly and inspect its login history. A failed login attempt does not necessarily mean someone got in. Password-reset emails you did not request can mean someone knows your email address, while changed settings, sent messages, new recovery methods, purchases, or successful logins are stronger signs of access.
Be careful not to lock yourself out during the cleanup. Before removing unfamiliar recovery details or MFA methods, confirm that your own phone number, email, authenticator, and backup codes still work. Then revoke every session, including ones that look familiar if the service allows it. Some attackers keep access through an existing session or connected application even after a password change. Check third-party app permissions, app-specific passwords, passkeys, trusted devices, and any “remember this browser” entries.
@compiler.bit is right about the carrier account. I would treat a sudden loss of mobile service differently from an ordinary account alert. Use another phone to call the carrier, since waiting for service to return may give someone more time to receive codes. Where possible, move important accounts away from text-message verification after regaining control.
Do not rush into a factory reset unless you have a safe copy of irreplaceable files and know how you will regain access afterward. Back up documents and photos, but avoid copying unknown installers, browser profiles, cracked software, or entire application folders onto the clean system. If the device held cryptocurrency wallets, tax records, identity documents, or saved payment details, assume the exposure may extend beyond the account where you first noticed trouble.
Expect follow-up scams. Once an attacker has your contact details, you may receive calls or messages pretending to be the bank, carrier, police, technical support, or an “account recovery specialist.” Do not give anyone a verification code, approve an unexpected sign-in prompt, install remote-control software, or pay someone who claims they can trace the hacker. Call organizations using the number printed on your card, statement, or official app.
Finally, keep a simple incident log with dates, account names, transaction amounts, case numbers, and who you contacted. That sounds tedious, but it matters if unauthorized charges reappear, an account recovery gets disputed, or identity fraud surfaces weeks later. Save the log somewhere the potentially compromised device or cloud account cannot alter.
Before you touch anything else, figure out where your passwords actually live. If you let your browser save logins and sync them to your Google or Apple account, that sync account is your real vault. So if the email @brightbuilder told you to lock down first is a Gmail tied to Chrome sync, the attacker may already have a plain list of everything you ever saved. Changing one password at a time doesn’t help much in that case. You’d want to check the saved-passwords list in the browser, wipe the ones you’re rotating, and confirm nothing weird is syncing to an unknown device.
The other thing worth doing early is a quick reality check on how they got in, because it changes your whole cleanup. A lot of what looks like a dramatic hack is just credential stuffing, meaning your old password leaked in some unrelated breach years ago and a bot tried it everywhere. If that’s it, the fix is boring: unique passwords plus MFA, done. It’s not malware, and a factory reset would be overkill. On the flip side, if you actually installed something or gave remote access, then yeah, @corelynx is right that the device stays suspect and password changes from it are pointless. Knowing which situation you’re in saves you a ton of wasted effort.
One small correction to the general vibe here: freezing your credit with all three bureaus is solid advice, but only bother if identity-level info was exposed, like your SSN or full identity documents. A login breach on a shopping account doesn’t warrant it. Match the response to what was actually reachable, otherwise you burn a weekend fixing problems you don’t have.
Do not leave your only backup plugged in or syncing while you clean this up. If the attacker reached your cloud account, deletions or encrypted files can spread to every connected computer and backup drive.
From a trusted device, pause cloud syncing and copy irreplaceable documents and photos to an external drive, then unplug it. Stick to ordinary data files. Do not preserve browser profiles, downloaded installers, scripts, cracked software, or whole application folders. Once the account is secure, check the cloud service’s trash, recent activity, shared folders, and file-version history. Attackers sometimes delete files or create public sharing links without making it obvious.
Set up a clean recovery channel too. A new email address created on a trusted device can be useful for support cases and recovery messages while your normal inbox is suspect. Keep it private and secure it with unique credentials and MFA. Do not delete the compromised address in a panic. You may still need its old messages, purchase receipts, account records, and username for recovery. If support is contacting an inbox the attacker can still read, assume they can see case numbers and reset links.
I would push back slightly on spending too long figuring out exactly how the intrusion happened before acting. Credential stuffing versus malware matters, as @kernelpilot1528 said, but containment comes first. Secure the recovery channels, cut off sessions, protect unsynced copies of your files, then investigate. If accounts become compromised again after being reset from a clean device, stop treating it as a simple leaked password. Something persistent, such as a stolen session, malicious app permission, carrier takeover, or infected device, is still in play.
If the likely attacker has physical access to your phone or computer, change the device unlock code and check for unfamiliar fingerprints, face profiles, user accounts, and family-sharing members. Account passwords will not do much if someone can unlock the device and approve resets. If this involves an abusive partner or household member, make changes from somewhere safe because removing access may alert them.
Reset any security questions and support PINs while you still control the account. Those can become a back door around a strong password and MFA, especially when the answers are easy to guess from social media. Use random, unrelated answers and save them in your password manager instead of answering truthfully.