Tool · Reader service

Generate an action plan

Tell me what is happening to you. You walk away with a list of concrete actions, in the right order, designed for France, with no jargon and no made-up figures, and you can have it sent to your inbox.

What is your situation?

You can no longer log in, or suspicious activity is showing up

Hacked account

An account (email, social media, bank, work login) has been taken over, or you suspect it has. The goal is to regain control fast, then shut off the attacker's access.

Which account is it?

Do you still have access to the account?

Was two-factor authentication enabled?

Right awayYour email account comes first: it is the one that lets anyone reset all the others, so lock it down first.

1
Change the password from a trusted device
Choose a long, unique password (a passphrase), never reused anywhere else. Do it from a device you trust, not the one that may have been compromised.
2
Lock down your email account first
It is the one that lets anyone reset all your other accounts: secure it before the rest, and check that no automatic forwarding rule has been added without your knowledge.
3
Turn on two-factor authentication (2FA)
This is what stops an attacker from coming back even with your password. Prefer an authenticator app or a physical key over SMS.
4
Sign out of all active sessions
In the account's security settings, close all other sessions and connected devices, to eject the attacker even if they are still logged in.
5
Check for hijacked settings
Forwarding or auto-reply rules, recovery number, backup address, authorized third-party apps, trusted contacts. Attackers often leave a door open here to come back.
6
Change the passwords of accounts that shared the same one
Any service where you used this password, or a similar one, is at risk. Use a different password per service, remembered by a password manager.
7
Warn the people who could be targeted
A hacked account is often used to scam your circle ("I have a problem, can you lend me...") or to pivot to other accounts. A short message to your contacts, especially on email and social media, puts them on guard.
8
Report it and get help
The public service 17Cyber (via cybermalveillance.gouv.fr) gives free, step-by-step guidance, and can point you to a professional if needed. If you have suffered harm, file a complaint.

Useful resources

Get this plan by email

Keep your action plan handy, or copy it in one click. One-time send, no strings attached.

These plans give general reflexes and are not a substitute for support tailored to your case. If in doubt, get help through the public service 17Cyber.

In 2025, account hacking took the lead among threats facing professionals, up 45%.

Source: Cybermalveillance.gouv.fr, 2025 activity report.

Éditions Spinelle · Out now

Être en cybersécurité

Order the book Training

Newsletter

Don't miss the next analysis

Hacked account

An account (email, social media, bank, work login) has been taken over, or you suspect it has. The goal is to regain control fast, then shut off the attacker's access.

Which account is it?

Do you still have access to the account?

Was two-factor authentication enabled?

Right awayYour email account comes first: it is the one that lets anyone reset all the others, so lock it down first.

Change the password from a trusted device

Choose a long, unique password (a passphrase), never reused anywhere else. Do it from a device you trust, not the one that may have been compromised.

Lock down your email account first

It is the one that lets anyone reset all your other accounts: secure it before the rest, and check that no automatic forwarding rule has been added without your knowledge.

Turn on two-factor authentication (2FA)

This is what stops an attacker from coming back even with your password. Prefer an authenticator app or a physical key over SMS.

Sign out of all active sessions

In the account's security settings, close all other sessions and connected devices, to eject the attacker even if they are still logged in.

Check for hijacked settings

Forwarding or auto-reply rules, recovery number, backup address, authorized third-party apps, trusted contacts. Attackers often leave a door open here to come back.

Change the passwords of accounts that shared the same one

Any service where you used this password, or a similar one, is at risk. Use a different password per service, remembered by a password manager.

Warn the people who could be targeted

A hacked account is often used to scam your circle ("I have a problem, can you lend me...") or to pivot to other accounts. A short message to your contacts, especially on email and social media, puts them on guard.

Report it and get help

The public service 17Cyber (via cybermalveillance.gouv.fr) gives free, step-by-step guidance, and can point you to a professional if needed. If you have suffered harm, file a complaint.