October 04, 2026
Account hacked? Breathe first, then kick them out
by Daniel
Sunday morning, half past eight in rural Bavaria. Murat is sitting at the kitchen table in his bathrobe, coffee steaming. Then his phone buzzes. And again. And again. His sister: "Since when are you into Bitcoin?" A mate from the pub: "400 percent returns in a week, seriously?" And his neighbour wants to know why he sent her a link to an "exclusive crypto group" at six in the morning.
Murat couldn't tell a crypto wallet from a waffle. His Instagram profile, on the other hand, is a total pro: it's posting stories with price charts, firing off direct messages every minute and showing Murat in sunglasses next to a Lamborghini. He doesn't own a Lamborghini. He does own the sunglasses, the photo is from Lake Garda. Someone else is holding the keys to his digital life, and Murat has two options: panic-tap everything that says "Help", or follow a plan. Spoiler: the plan wins.
October is European Cybersecurity Month, a good excuse to read this plan before you need it. Small comfort: according to a representative survey by the consumer advice centre in North Rhine-Westphalia, almost one in three people has been hacked at some point. You're in good company.
How to tell you've been hacked
A hack rarely arrives with a drumroll. It's usually a handful of small oddities that are easy to brush off:
- A sign-in alert from a device or place you don't recognise. "New sign-in from Romania" while you're having breakfast in Bavaria is not a great sign.
- Emails saying your password, email address or phone number was changed. Not by you.
- Your password suddenly stops working, even though you're sure you're typing it correctly.
- Your "Sent" folder holds emails you never wrote, or suspiciously few emails are coming in. Hello, hidden forwarding rule.
- Friends ask about weird messages, links or requests for money from you.
- Order confirmations or payment reminders for things you never bought.
Before you panic: type your password once more, slowly, Caps Lock off. If it still fails and another warning sign fits, this isn't a glitch, it's a break-in. Now time matters, because with your inbox an attacker can reset more passwords and message your contacts.
The emergency plan: order matters
Don't start clicking around wildly. The order isn't red tape. It stops you from locking the front door while the back door is still wide open.
Step 1: Device first, everything else second
If you recently installed a shady app or opened a strange attachment, malicious software (malware) may be reading what you type. Then the attacker gets your shiny new password delivered straight to them. How convenient. For them. So run the rescue from a device you trust and start a full virus scan on the suspicious one. On Windows, open the "Windows Security" app and go to "Virus & threat protection", "Scan options", "Full scan".
Step 2: Your email account comes first
Your inbox is the master key: almost every service sends its "forgot password" link there. So even if it looks like only Instagram was hit, you secure the email address linked to it first. In Murat's case, an ancient Gmail account he only uses for newsletters. Exactly the kind of inbox nobody keeps an eye on.
- Change the password: long, unique, never used before. A passphrase of four or five random words is easier to remember than "Xk7!pQ" and still stronger.
- Check the recovery phone number and recovery email. Attackers love adding their own, so they can stroll back in later.
- Review security events: Google lists recent activity in the "Security" section. Anything that wasn't you gets a "No, it wasn't me".
Can't get in at all? Skip to the "Locked out?" section below.
Step 3: End every session
Anyone already inside often stays inside after a password change. A session is like a festival wristband: once you're past the gate, nobody checks your ticket again. So you cut every wristband you didn't hand out:
- Google: open the device overview at google.com/devices and sign out every device you don't recognise.
- Microsoft (Outlook, Hotmail): "Advanced security options", scroll down to "Sign out everywhere". This can take up to 24 hours, and Xbox consoles need to be signed out separately.
- Instagram and Facebook: Accounts Center, "Password and security", "Where you're logged in", select unknown devices and log them out.
- WhatsApp: "Settings", "Linked devices", remove anything that isn't yours. Otherwise a stranger's WhatsApp Web keeps happily reading along.
Step 4: Turn on MFA, and do it right
MFA (multi-factor authentication) means you need a second proof on top of your password, usually your phone. A stolen password alone is no longer enough. But not all MFA is created equal:
- Passkey: the gold standard. A digital key on your device, unlocked with your fingerprint, face or PIN, and tied to the real web address. On a phishing site it simply doesn't work. Germany's Federal Office for Information Security (BSI) counts passkeys among the methods that also protect against real-time phishing.
- Authenticator app: a solid choice where a service doesn't support passkeys yet. It generates a new code every 30 seconds, no mobile network needed.
- SMS code: better than nothing, but the weakest option. With SIM swapping, fraudsters get a replacement SIM issued for your number and receive your codes.
And this one's important: a code that arrives on your phone by text is yours alone. That's exactly how Murat got caught. The Tuesday before, "Petra from the gym" had messaged him: she was locked out, could he quickly forward the code about to land on his phone? It wasn't Petra. It was the reset code for Murat's own Instagram account.
Step 5: Close the back doors
Savvy attackers like to leave themselves a back door that survives every password change. In Gmail you'll find the key spots via "See all settings":
- "Forwarding and POP/IMAP": an unknown address here gets a copy of every email you receive. Including every new password reset link. In Outlook, forwarding lives in the mail settings.
- "Filters and Blocked Addresses": a favourite trick is a filter that sends security alerts straight to the bin. So you don't notice a thing.
- "Accounts and Import": shows who else has access to your inbox.
- Connected apps: anything granted access via "Sign in with Google" (the technology is called OAuth) keeps that access even after a password change. Check the third-party apps and services list in your Google Account and Accounts Center at Meta. Remove everything you don't recognise.
Pro tip: screenshot each suspicious entry before deleting it. That's evidence for the police report.
Step 6: Stop the password recycling
Where else have you used that password? Attackers automatically try stolen credentials on hundreds of services. It's called credential stuffing, basically a slot machine fed with your data. Everywhere the same or a similar password was in use, it gets changed now. And no, "Murat1974!" instead of "Murat1974" doesn't count. Nice try, Murat.
Locked out? The official ways back in
If the attacker has changed your password, number and email address, only official account recovery will help. It can be slow, but it's free and the only legitimate route. First, check your inbox: many providers send an email after a change with a link like "Undo this change". Click it fast and you save yourself a lot of trouble.
Start recovery via "Forgot password?" and answer the questions as best you can. Wrong answers don't end the process, you can try as often as you like. Google doesn't handle sign-in problems by phone and explicitly doesn't work with services claiming to help. After recovery details are changed, it can take up to seven days for them to take effect.
Microsoft
Try the sign-in helper first, then the account recovery form as a last resort. Fill it in on a device and from a place where you usually use the account, and include old passwords, email subject lines and contacts. You'll get an answer within 24 hours, and you can try up to twice a day. The bitter pill: if two-step verification is on and you've lost every verification method, support can't help either.
Apple
Account recovery starts at iforgot.apple.com, and the waiting game is deliberate: you'll usually get a confirmation within 72 hours with the date and time when you can continue. Support can't speed it up, and repeated requests tend to make it longer. If you're still signed in on another device, the fastest route is to change your password right there.
Instagram and Facebook
The entry points are instagram.com/hacked and facebook.com/hacked, where you request a login link or security code. If the attacker has changed everything, Instagram may ask for a video selfie to verify your identity. Send one request per channel, ten in a row won't speed anything up. Germany's consumer advice centres (Verbraucherzentrale) say replies can take hours or weeks, and in urgent cases also writing to the address in Instagram's legal notice can help.
Register your number again in the app and confirm with the six-digit SMS code. That kicks the intruder out. If WhatsApp asks for a PIN you never set, the attacker set it: after a seven-day wait you can get in without it, and the thief stays locked out in the meantime. Afterwards, go to "Settings", "Account" and turn on "Two-step verification" with your own PIN.
Stay away from "recovery services"
The moment you post "Help, my Insta got hacked", amazingly helpful strangers pop up in the comments: "DM @recovery_pro, he fixed mine in ten minutes!" It's a scam. They want money upfront, your login details, or both, and you end up scammed twice. Real recovery only happens through the provider and costs nothing. Instagram has no phone hotline for personal accounts, and Google doesn't discuss sign-in problems by phone. Anyone calling you as "support" isn't.
Damage control: friends, money, shopping
Warn your contacts
Your contacts are now the real target. Warn them through a different channel: anything coming from your account right now isn't from you. No links, no codes, no money. Ask them to report the profile to the platform. And once you're back in, post a short all-clear.
Block payment methods
Were payment details stored, or is your online banking linked to the affected address? Contact your bank and block cards if in doubt. In Germany, the 116 116 blocking hotline runs around the clock, is free from German landlines and can block girocards, most credit cards, online banking access and SIM cards, provided the issuer participates. From abroad, dial +49 116 116. Save the number now, not when your phone is already acting up.
Shopping accounts
- Check your order history, cancel orders you didn't place, tell the shop.
- Check delivery addresses: an unfamiliar parcel locker is a classic sign.
- Delete saved cards you don't need. What isn't stored can't be spent.
- Keep an eye on your bank statements over the coming weeks.
Secure evidence and report it
Unauthorised access to someone else's account is a criminal offence, and a report helps you later if someone signs contracts in your name. So before you clean up, secure:
- Screenshots of messages, posts and changed settings, ideally with the date visible.
- Your provider's security emails ("New sign-in", "Password changed"), moved into a separate folder instead of deleted.
- The headers of suspicious emails, an email's technical letterhead with sending server and timestamps. In Gmail via the three dots and "Show original".
- A short timeline: when did you notice what, and what did you change when?
In most German states you can report the crime through the police online reporting portal (Onlinewache), essentially a digital police station. The state where the crime took place is responsible. According to the consumer advice centres, going to a police station in person is often even more useful, because you can present your evidence directly. And if it all hits you harder than you'd like to admit: the victim support organisation Weißer Ring runs a helpline on 116 006, daily from 7 am to 10 pm.
Am I in a data leak, too?
Often the password comes from an old breach at some long-forgotten service. You can check for free with the HPI Identity Leak Checker (sec.hpi.de/ilc) from the Hasso Plattner Institute, Have I Been Pwned (haveibeenpwned.com) by security researcher Troy Hunt, or the University of Bonn's Leak Checker (leakchecker.uni-bonn.de). A hit means: that password is burnt. Get rid of it, everywhere.
Afterwards: four habits for a quiet life
Survived the hack? Now make sure it stays a one-off episode and doesn't turn into a whole season.
1. A password manager
A digital safe that remembers all your passwords and generates new random ones. You only need one strong master password. Bonus: it only fills in on the real website. If it offers you nothing on "lnstagram-security.com" (lowercase L, not a capital i), that silence is your warning sign.
2. A unique password for every service
No exceptions, no exclamation mark tacked on the end. Then a breach at some knitting forum is exactly that: a breach at a knitting forum. Not the master key to your entire life.
3. Passkeys wherever possible
Many big services offer them now, just look for "passkey" in the security settings. After that you sign in with your fingerprint or face. No password to phish, no code a fake Petra can sweet-talk out of you.
4. Keep recovery codes offline
The backup codes you get when setting up MFA are your spare key for the day your phone takes a swim in the sink. Print them and file them with your important papers, not as a photo in your gallery. And keep your recovery details current: the phone number you had ten years ago won't save you.
Checklist to tick off
- Switched to a clean device, scanned the suspicious one
- Changed the email password, checked recovery number and address
- Signed out all unknown sessions and linked devices
- MFA on, ideally with a passkey or authenticator app
- Checked forwarding, filters and connected apps
- Changed every reused password
- Warned contacts through a different channel
- Checked payment methods and shopping accounts, blocked via 116 116 if in doubt
- Secured evidence, filed a police report
- Ran a leak check
- Printed backup codes and stored them safely
And Murat?
Murat's coffee went cold, but he got everything else right: laptop instead of phone, the old Gmail account first, then Instagram via the official help page. Two days and one video selfie later (very wanted-poster chic), the account was his again. He also called Petra from the gym. The real one. Her account had been hijacked too. Now she has this article.
You don't have to wait until your Sunday is ruined. Take ten minutes today, check your recovery details and switch on that second factor. Turn on MFA. Think purple.