Incident Response: What to Do When Things Go Wrong
Even with good security habits, incidents can happen: accounts get hacked, devices are lost, malware appears, files are exposed or suspicious activity shows up. This chapter explains how to respond quickly, reduce harm and recover without making the situation worse.
Overview
Security incidents are stressful because they combine uncertainty, urgency and risk. The worst response is panic-clicking through settings, deleting evidence, warning nobody or continuing to use a compromised device as if nothing happened.
A good incident response process is simple: identify what happened, contain the damage, secure accounts and devices, preserve useful evidence, notify affected people if needed, and improve defenses afterward.
Recognizing security incidents
Not every strange email or device glitch means compromise. But some signs deserve immediate attention, especially when they involve accounts, logins, files, device behavior or messages sent without your knowledge.
Unrecognized account activity
New logins from unfamiliar devices or locations, password reset emails, changed settings or unexpected 2FA prompts can indicate attempted or successful account compromise.
Messages you did not send
If contacts receive strange links, attachments or requests from your account, assume the account may be compromised until proven otherwise.
Suspicious device behavior
Sudden slowdowns, unknown apps, changed settings, browser redirects or security tools being disabled may suggest malware or tampering.
Lost, stolen or seized devices
A missing phone, laptop or drive becomes a security incident when it contains sensitive accounts, files, contacts, messages or authentication tools.
Do not dismiss alerts from Google, Microsoft, Apple, Meta or other services about suspicious logins. These warnings are often the earliest sign that something is wrong.
Responding to compromised accounts
If you suspect an account has been hacked, the priority is to regain control and prevent the attacker from staying inside. Use a clean device whenever possible — not the device you suspect may be infected.
Change the password
Use a strong, unique password. If reused elsewhere, change it everywhere it was used.
Enable 2FA
Turn on two-factor authentication, preferably app-based or security-key based.
Log out sessions
Use account settings to sign out all other devices and active sessions.
Check recovery settings
Remove unknown recovery emails, phone numbers, forwarding rules or connected apps.
Email accounts deserve special attention because they are often used to reset other accounts. After regaining access, check forwarding rules, filters, backup emails, recovery phone numbers, connected apps and recent login activity.
If your account may have sent malicious links or messages, notify relevant contacts quickly. A short warning can prevent the attack from spreading through your network.
Lost devices, stolen phones and malware
Device incidents require fast containment. The right action depends on what happened: a lost phone, a stolen laptop, a suspicious attachment, malware symptoms or a device returned after being out of your control.
Use remote locate or wipe
Locate or erase a lost phone or laptop if remote wipe is available and appropriate.
Change key passwords
Change passwords for accounts logged in on the missing or compromised device.
Disconnect first
Disconnect suspected infected devices from the internet before continuing sensitive work.
Use a trusted device
Change passwords and recover accounts from a clean device, not the suspected infected one.
If malware is suspected, avoid logging into important accounts from the affected device. Back up necessary files carefully, scan with reputable tools, and consider wiping and reinstalling the operating system if the risk is serious.
Treat it as potentially compromised. Depending on the risk, wipe and rebuild it, replace it, rotate passwords, revoke sessions and check whether any sensitive files or contacts may have been exposed.
Recovery, documentation and learning
After immediate containment, document what happened. This helps you understand the scope, warn the right people, recover properly and prevent repeat incidents.
You do not need a complex report. A simple timeline is useful: when the incident was noticed, what account or device was affected, what actions were taken, what data may have been exposed, who was informed and what needs follow-up.
Preserve useful evidence such as suspicious emails, headers, screenshots and login alerts.
List affected accounts, devices, files, contacts and services.
Notify affected colleagues, partners or contacts when exposure could create risk for them.
Review what allowed the incident: weak password, no 2FA, phishing, outdated software or lost device.
Update team procedures, access permissions and training based on the incident.
Ask for expert help when the incident involves spyware, legal risk, sensitive sources or high-risk adversaries.
Incidents are easier to contain when people report them quickly. If staff fear blame, they hide mistakes. Hidden mistakes become bigger incidents. Great system, obviously.
Incident response checklist
Use this checklist when something seems wrong: hacked account, suspicious login, lost device, malware, phishing mistake or exposed file.
I stop using any device I suspect may be infected or compromised.
I use a clean device to change passwords and recover accounts.
I change exposed passwords and any reused passwords immediately.
I enable or reset two-factor authentication on affected accounts.
I log out all other sessions from compromised accounts.
I check recovery emails, phone numbers, forwarding rules and connected apps.
I remotely locate or wipe lost or stolen devices when appropriate.
I preserve evidence such as suspicious messages, screenshots and login alerts.
I notify contacts if they may receive malicious messages from my account.
I document what happened and what response actions were taken.
I review what allowed the incident and improve defenses afterward.
I seek expert support for serious incidents, spyware concerns or high-risk situations.
Useful tools and references
These tools and references can help with account recovery, breach checking, suspicious files, lost devices and expert incident support.
Take the final chapter quiz, then return to the course overview
Take the short anonymous quiz for this chapter. Your individual result is not stored on the server. After finishing, return to the Start Learning page to review other chapters or revisit any topic.
Download the full Digital Security Toolkit
Prefer reading offline or sharing the material with your team? Download the full PDF version of the Digital Security Toolkit.