Account hacked or data leaked – What should you do?
A hacked account can have serious consequences. Cybercriminals may be able to read your emails, access payment services or social media accounts, or take over other accounts you use. They often get in using login details stolen through phishing or a data leak. If you act quickly and take the right steps, you can limit or prevent further damage.
Passwords can be stolen through phishing or malware. Large batches of passwords also regularly fall into the wrong hands after data leaks. Unfortunately, people often only realise that their password has been stolen once it's too late – for example, when they suddenly can't access online services such as email, online shopping or social media accounts.
Look out for logins or attempted logins from unfamiliar locations or at unusual times. Large companies such as Apple, Google and Microsoft will usually notify you in these cases. Changes to your settings, or messages sent from your account that clearly did not come from you, are also warning signs. But access warnings can also be fake. Scammers use them to trick people into clicking on phishing links or calling phone numbers. Never click on links in these emails. Instead, type the address of the service directly into your browser, log in there and check whether you need to take any action.
You can use iBarry's data leak checker to find out whether passwords for online services linked to your email address have been leaked.
Online account hacked
If you think your account has been hacked, act quickly and follow these steps:
- If you still have access to the account, change the password immediately. Make sure your new password meets current recommendations for strong passwords.
- If the account is with a financial service provider, contact them immediately.
- If you no longer have access to the account, use the password reset function. In most cases, a reset link or code can be sent to the account's recovery email address.
- If the attackers have also changed the recovery email address, contact the provider directly. Many providers have an account recovery process where you have to verify your identity. If the recovery process does not work the first time, try again.
- Enable two-factor authentication wherever possible to better protect your account in future.
- Update the operating systems and applications on your devices and run a scan using up-to-date antivirus software.
Special case: email accounts
If your email account has been hacked, check whether any forwarding rules have been set up. Scammers often create these rules so that they can continue receiving copies of your emails even after you have changed your password. If someone else has set up a forwarding rule, remove it immediately. Once you regain control of your email account, you should reset the passwords for all the online services linked to it. Scammers may have used the password reset function to access those services too. Let everyone in your email contact list know that your account has been hacked. This will help prevent your contacts from falling for scams sent in your name.
What should you do if your personal data has been stolen?
During a cyberattack, criminals may steal not only your passwords, but also personal data such as your name, address or bank details. The following steps can help you limit the damage:
- Find out which data is affected, as the steps you need to take will depend on the type of data involved.
- If your bank details or credit card information have been stolen, contact your bank immediately, have any affected cards blocked and check your account statements for suspicious transactions.
- Report the matter to the police, especially if you have suffered financial loss.
- If your data has been used to place fraudulent orders or open accounts, inform the online services concerned immediately and change your login details. Report the matter to the police as soon as you discover any misuse.
- In the weeks after the incident, be especially wary of targeted phishing attempts or contact from people you do not know.