Think Your Account Was Compromised? Act Now
Think Your Account Was Compromised? Act Now
Possible account compromise includes more than a failed login. Warning signs can include an unexpected password-reset or MFA message, unfamiliar sign-in alert, sent messages you did not write, changed forwarding rules, missing mail, new authentication methods, altered recovery information, unfamiliar purchases, or coworkers receiving strange requests from your account. A trusted contact telling you that your account sent an unusual message is also a security alert.
First actions
- Contact Zerolimit immediately using a known phone number, portal, or support address. If your work email may be compromised, use a different trusted communication method. State which account is affected and what you observed.
- Do not continue normal work in the suspected account. Avoid sending messages that could confuse recipients or tip off an attacker. Zerolimit may ask you to pause use while sessions are revoked and settings are reviewed.
- Do not click an alert’s links. Open the service from a trusted bookmark, known application, or address you type yourself. Attackers often send fake “account compromised” notices to steal credentials.
- Follow Zerolimit’s direction for password changes. Use a known-good device. Create a strong, unique password that has never been used on another account. Do not make the change from a device showing malware or browser-tampering warnings unless instructed.
- Deny unexpected MFA prompts and never share verification or backup codes.
Google’s official recovery guidance recommends reviewing recent security events, checking devices that use the account, changing the password, and removing unfamiliar access.[1] Microsoft likewise provides a recovery process for hacked or compromised accounts.[2] For a managed work account, let Zerolimit coordinate these actions so session revocation, logging, retention, and business impact are handled correctly.
Tell Zerolimit exactly what happened
Provide the username, first known time, warning signs, and any action you took. Say whether you entered a password on a suspicious page, approved MFA, installed software, opened an attachment, sent money, or disclosed information. Mention reused passwords, connected apps, shared mailboxes, delegate access, and sensitive systems reachable from the account. Accuracy is more useful than embarrassment or guesswork.
If suspicious messages were sent from your account, do not mass-email everyone yourself. Zerolimit can help identify recipients, preserve message details, remove malicious mail where possible, and issue a clear warning through a trusted channel. If financial or payroll data was changed, notify the appropriate finance or HR leader as directed and use established verification procedures.
What not to do
Do not delete suspicious messages, sign-in notices, mailbox rules, files, or browser history. Do not factory-reset a device, uninstall security software, run internet “cleanup” tools, or attempt to trace the attacker. Do not confront the attacker or reply to suspicious messages. These actions can destroy useful evidence, spread the incident, or create additional risk.
Do not assume a password change alone ends the incident. An attacker may still have an active session, malicious mailbox forwarding, an added recovery method, an application token, or access to another account where the password was reused. Zerolimit should confirm containment.
After immediate containment
At Zerolimit’s direction, review account recovery details, MFA methods, recent activity, connected applications, mail forwarding, and inbox rules. Remove only items confirmed to be unauthorized. Reauthenticate trusted devices after sessions are revoked. Change reused passwords on other services, prioritizing the email account and any account that can reset others.
Notify Zerolimit promptly if new symptoms appear after recovery: fresh prompts, messages moving or disappearing, another unfamiliar login, or recipients reporting new scams. Continue using MFA. CISA recommends strong, unique passwords, a password manager, and MFA as core account protections.[3]