What to change when youve been hacked?

what to change when youve been hacked: Key Steps

Knowing what to change when youve been hacked helps protect your personal data from unauthorized access. Reviewing essential account recovery methods prevents further compromise and safeguards your online presence effectively. Learn the complete sequence of security measures to restore full account safety.

What to do if your account is hacked: The Immediate Response

Immediately disconnect your device from the internet, then change all your passwords from a safe, uncompromised device. Secure your accounts by enabling multi-factor authentication, check for rogue email forwarding rules, run an antivirus scan, and freeze your credit if financial data was exposed.

Many people focus on changing passwords first, but an equally important step is making sure you use a trusted, uncompromised device before updating any account credentials.

Resetting passwords from a device that is still infected can expose your new credentials to attackers. Isolate potentially compromised devices first, then complete account recovery from a trusted device.

Step 1: Disconnect Everything and Scan for Malware

Before changing anything after a hack, disconnect the affected device from the internet by turning off Wi-Fi or unplugging the ethernet cable.

Disconnecting the device helps prevent attackers from maintaining remote access or continuing to transmit data while you begin the recovery process.

Next, run a comprehensive malware and antivirus scan. If the compromise is severe or you cannot verify the device is clean, consider performing a factory reset or reinstalling the operating system before restoring your data from a trusted backup.

Step 2: Change Your Passwords (The Right Way)

A common mistake is changing passwords on the same device that may have been compromised.

If the device is still infected with malware, newly created passwords may also be exposed to the attacker.

If there is still malware on your computer, you are just handing the attacker your brand new credentials. You must use a safe, uncompromised device - like your secondary phone on a cellular network - to change all your passwords from a safe, uncompromised device. Start with your email and financial accounts, as those act as the master keys to your digital footprint.

Multi-factor authentication blocks approximately 99% of automated credential stuffing attacks. Turn it on for every single service that offers it. Then, log out everywhere. Most platforms have a button to terminate all active sessions, ensuring the attacker is immediately kicked out of your accounts.

Step 3: Check Email Forwarding Rules

Attackers often create unauthorized email forwarding rules or filters to maintain access after an account has been compromised, so these settings should be reviewed carefully.

Hackers may create unauthorized email forwarding rules or filters that silently send copies of password reset messages and other sensitive emails to accounts they control. Review and remove any rules you do not recognize.

Verify that the hacker has not changed your recovery phone number or alternate email address. If they did, they can just click forgot password tomorrow and regain access.

Step 4: Secure Finances and Freeze Your Credit

If financial data or your Social Security number was compromised, set up fraud alerts immediately. You need to freeze your credit with the major bureaus (Equifax, Experian, and TransUnion) to prevent new accounts from being opened in your name.

Recovering from identity theft can be time-consuming and stressful. Placing a fraud alert or credit freeze promptly can help reduce the risk of additional fraudulent accounts being opened in your name. This is an essential part of what to change when youve been hacked.

Choosing Your Post-Hack Authentication Method

After a hack, upgrading your security is non-negotiable. Relying on a password alone is no longer enough. Here is how the main protection methods compare.

Standard Passwords

Low. Easily compromised through phishing or data breaches

Only for low-risk accounts with zero personal data attached

High, assuming you reuse them, which is exactly why they fail

SMS Two-Factor Authentication

Moderate. Better than nothing but vulnerable to SIM-swapping attacks

Good for platforms that do not support dedicated app authenticators

Very high, as almost everyone has a phone that receives texts

Authenticator Apps (Recommended)

Very High. Codes are generated locally on your device, immune to SIM-swapping

Essential for primary email, banking, and critical infrastructure accounts

Moderate. Requires downloading an app like Google Authenticator or Authy

Identity Theft Recovery Journey

David, a 42-year-old small business owner, noticed unusual charges on his corporate card and immediately logged into his bank to change the password.

His first attempt made things worse. He used his work laptop, which was infected with a keylogger. The attackers captured the new password instantly and initiated a massive wire transfer.

The breakthrough came when an IT consultant told him to physically disconnect his router. David moved to a brand new tablet on a cellular connection to freeze his credit and reset his master email credentials safely.

By isolating the network first, David stopped the bleeding. It took a week to wipe his computers, but securing the accounts from a clean device prevented a total business collapse and saved roughly $45,000 in unauthorized transfers.