If you think you've been hacked
What to do after a suspicious login, compromised account, phishing mistake or possible device infection — without making the situation worse.
Last reviewed: October 2026
Something odd has happened: an unexpected login alert, a password has stopped working, messages have been sent from your account, you clicked a convincing phishing link, or a device is behaving strangely. The important thing is to respond calmly and avoid destroying useful evidence.
If there may be immediate danger
If the incident could expose a confidential source, put somebody at physical risk or involve a highly sensitive investigation, stop using the affected account or device for sensitive work. Contact your organisation’s security or IT team from another trusted device or channel.
For journalists, media organisations and civil-society groups facing a serious or targeted digital attack, Access Now’s Digital Security Helpline provides free 24-hour assistance. CPJ and Reporters Without Borders also provide emergency support for journalists.
If an account may be compromised
From a device you trust:
- change the password and make it unique;
- check recent sign-ins and sign out unfamiliar sessions;
- check recovery email addresses and phone numbers have not been changed;
- turn on a passkey or two-step verification if it is not already enabled;
- review forwarding rules, connected applications and delegated access, particularly in email accounts;
- save screenshots or alerts that may help establish what happened.
If the same password was used elsewhere, change those accounts too — starting with email and other accounts that can be used for recovery.
If you clicked a phishing link
Clicking a link does not automatically mean the device is compromised. The important question is what happened next. If you entered a password, change it. If you approved a login or MFA request, review active sessions. If you downloaded or ran software, get the device checked.
Tell your security team what happened. A quick report is far more useful than quietly hoping nothing happened.
If a device may be infected or targeted
Disconnecting a device from networks may sometimes limit further access, but do not automatically wipe, reset or reinstall it if the incident may be targeted or serious. That can destroy evidence needed to understand the attack.
Use another trusted device for sensitive communications and seek specialist advice. If the problem is ordinary malware rather than a targeted attack, your IT/security team can advise on cleaning or rebuilding the device safely.
Warn people who may be affected
If an attacker could impersonate you, contact colleagues or sources through a different trusted channel. Be specific about what they should distrust — for example, recent messages asking for files, money, credentials or a change of contact details.
Afterwards
Once the immediate problem is contained, work out how the compromise happened and what needs to change. That may be as simple as replacing a reused password, or it may require reviewing devices, accounts, recovery methods and working practices.
The aim is not to assign blame. It is to prevent the same route being used again.