My plan, in six questions

Hacked account

An account (email, social media, bank, work login) has been taken over, or you suspect it has. The goal is to regain control fast, then shut off the attacker's access.

1. 1
   Change the password from a trusted device

   Choose a long, unique password (a passphrase), never reused anywhere else. Do it from a device you trust, not the one that may have been compromised.

2. 2
   Lock down your email account first

   It is the one that lets anyone reset all your other accounts: secure it before the rest, and check that no automatic forwarding rule has been added without your knowledge.

3. 3
   Turn on two-factor authentication (2FA)

   This is what stops an attacker from coming back even with your password. Prefer an authenticator app or a physical key over SMS.

4. 4
   Sign out of all active sessions

   In the account's security settings, close all other sessions and connected devices, to eject the attacker even if they are still logged in.

5. 5
   Check for hijacked settings

   Forwarding or auto-reply rules, recovery number, backup address, authorized third-party apps, trusted contacts. Attackers often leave a door open here to come back.

6. 6
   Change the passwords of accounts that shared the same one

   Any service where you used this password, or a similar one, is at risk. Use a different password per service, remembered by a password manager.

7. 7
   Warn the people who could be targeted

   A hacked account is often used to scam your circle ("I have a problem, can you lend me...") or to pivot to other accounts. A short message to your contacts, especially on email and social media, puts them on guard.

8. 8
   Report it and get help

   The public service 17Cyber (via cybermalveillance.gouv.fr) gives free, step-by-step guidance, and can point you to a professional if needed. If you have suffered harm, file a complaint.