I Think I’ve Been Hacked: What to Do in the First Hour
If you think an account, device or business system has been hacked, focus on limiting further harm. You do not have to identify the attacker before taking sensible steps. If this involves a work account or business system, contact the person who administers it as soon as possible and coordinate changes with them.
Protect money and people first
If a bank, payment service or invoice account may be involved, contact the bank or payment provider using a number from its official website or your card. Ask it to secure access and review suspicious transactions. Do not use a phone number or payment link included in an unexpected email.
If someone may receive fraudulent messages from your email or business account, warn them through a separate trusted channel, such as a known phone number. Ask them to verify payment changes and urgent requests independently.
Use a device you trust
Do not change passwords or access banking from a device you believe is infected. Use a different, updated phone or computer that you trust. If a personal device shows active signs of compromise, disconnect it from Wi-Fi and wired networks while you seek help.
For a business computer, server or managed device, contact IT before disconnecting it, deleting files, reinstalling software or running cleanup tools. A change made without coordination can interrupt services or remove evidence needed for investigation.
Secure the accounts that unlock others
Start with the email account used for password recovery, then secure other affected accounts. Use each provider’s official recovery or security page. Set a unique password that is not reused elsewhere, turn on multifactor authentication where available, and review recovery email addresses and phone numbers.
Sign out sessions and devices you do not recognise. Check connected apps, app passwords, delegated access, forwarding addresses, inbox rules and filters. Remove changes you did not make, but record them first if an administrator or investigator may need to review them.
If email for your own domain is affected, find out which provider actually hosts the mailbox and contact that provider or your administrator. A domain’s website or DNS can be with one company while its email is hosted elsewhere.
Keep a short incident record
Write down when you first noticed the problem, which accounts or devices may be involved, what looked wrong and what actions you have taken. Keep suspicious messages, security alerts, transaction details and screenshots in a safe place. Preserve original emails if possible; forwarding a message can remove technical details. Never post passwords, sign-in codes or private keys publicly.
Get help for serious or recurring incidents
Contact an administrator or qualified incident responder if a business mailbox, administrator account, server, domain registrar, payment service or sensitive data may be involved; if the attacker returns; or if you cannot determine what was accessed. If personal information may have been exposed, check the notification duties that apply in your jurisdiction. In Singapore, organisations should assess whether a breach is notifiable and follow current PDPC guidance.
The first hour is about reducing exposure and keeping a clear record. Once access is contained, the administrator or responder can investigate how it happened and check whether other systems were affected.
Official guidance
Federal Trade Commission — https://consumer.ftc.gov/articles/how-recover-hacked-email-or-social-media-account
CISA small and medium business resources — https://www.cisa.gov/small-and-medium-business-resources
Singapore PDPC notification guidance — https://www.pdpc.gov.sg/required-to-notify-the-pdpc