You Just Got Hacked — The First 10 Minutes

If you're reading this, something bad probably just happened. That's okay. You're not the first person this has happened to, and you won't be the last. Let's focus on what you can do right now.

## What this guide covers

- How to lock things down immediately so the damage stops spreading - What to do in the first hour to start taking back control - How to figure out what actually happened - What comes next after the dust settles

---

## Right Now (The Next 10 Minutes)

### 1. Change your passwords — start with your email

Your email is the master key. If someone controls your email, they can reset the password on almost everything else. Change your email password first.

If you can't get into your email, skip to Step 3.

Pick something long and random. Now is not the time for something memorable — write it down on paper if you need to. You can sort it out later.

### 2. Log out everywhere

Most email and social media platforms have an option to "sign out of all devices" or "sign out of all sessions." Use it. This kicks out anyone who's currently in your account.

Where to find this: - **Gmail:** Google Account → Security → Your devices → Sign out of all devices - **Outlook:** Microsoft Account → Security → Sign-in activity - **Social platforms:** Usually under Settings → Security → Active sessions

Don't worry if your platform isn't listed here. Look under "Security" or "Privacy" in your account settings — most services have this option somewhere.

### 3. If you're locked out of your account

Don't panic. Most platforms have an account recovery process.

Go directly to the platform's website (not through a link someone sent you). Look for "Can't sign in?" or "Account recovery." You'll usually need to verify your identity through a backup email, phone number, or security questions.

This can take time. Start the process now so it's moving while you handle the rest.

### 4. Check your bank and payment apps

Open your banking app or website and look at your recent transactions. If you see anything you don't recognise, call your bank's fraud line immediately — you'll find the number on the back of your card or inside your banking app.

Most banks can freeze your card instantly while they investigate. Don't hesitate to ask for this.

---

## Within the First Hour

### 5. Turn on two-factor authentication (2FA)

If you've managed to get back into your accounts, turn on 2FA right now. This means even if someone has your password, they can't get in without a second code — usually sent to your phone.

This is the single most effective thing you can do to stop this from happening again.

> **Not sure how to set this up?** We have a separate guide: *Set Up 2FA in 5 Minutes (And Why You Should)*

### 6. Check what's connected to your accounts

Hackers sometimes connect third-party apps or forwarding rules to your accounts so they can keep access even after you change your password.

Things to look for: - **Email forwarding rules** you didn't create (someone forwarding copies of your emails to themselves) - **Connected apps** you don't recognise (under your account's security or privacy settings) - **Recovery email or phone number changes** — make sure these are still yours

Remove anything that looks unfamiliar.

### 7. Scan your devices

Run an antivirus or security scan on your phone and computer. If you don't have antivirus software, most operating systems have built-in options — Windows Defender on Windows, or XProtect on Mac. On your phone, make sure your operating system is up to date.

This helps catch any malware that may have caused the hack in the first place.

---

## Figure Out What Happened

Once you've locked things down, take a breath. Now it's worth understanding what actually happened — not to blame yourself, but so you know what to watch for going forward.

Ask yourself: - Did you click a link in an email or message that seemed off? - Did you reuse the same password across multiple sites? - Did you get a notification about a login from a location or device you don't recognise? - Did someone you know also get hacked recently?

You don't need to become a detective. But knowing the "how" helps you protect yourself next time, and it's useful information if you decide to file a report.

---

## What Comes Next

### Change your other passwords

If you reused the password that was compromised on other sites (no judgement — most people do), change those too. A password manager can help you keep track of unique passwords going forward.

### Monitor your accounts

Over the next few weeks, keep an eye on your email, bank accounts, and social media for anything unusual. Set up login alerts if your platforms offer them — you'll get a notification any time someone signs in from a new device.

### Report it

You may want to report what happened to your local cyber authority or police. This helps build a record and can sometimes help with recovery.

> **Ready to report?** Visit our [Resources page] to find the right contacts for your country.

### You're not alone

Getting hacked feels violating and overwhelming. But you've already done the hardest part — you took action. Millions of people go through this, and it doesn't mean you did something wrong.

> **Want to hear how others got through this?** Head to our [Stories page] to read real experiences from people who've been where you are.

---

*This guide is part of the StillOnline.org emergency series. Written in plain language for real people dealing with real situations.*