1. Contain
Secure the affected account, end unknown sessions and remove suspicious forwarding or app access.
Calm, ordered incident support
Data Breach Response and Account Recovery
If a password has been exposed, a login looks unfamiliar, or your email or banking account has been taken over, take the next steps in the right order. Osborne & Davies Digital Guard supports hacked account recovery across London, Croydon and the UK.
Start with the email account.
Tell us which account is affected and what you noticed. Never send us your password or a one-time security code.
01 / Contain the incident
First Actions in the First Hour
Work through these steps in order. If you cannot get into an account, use the provider's official recovery process and keep a note of the steps you have taken.
Act in this order.
-
01
Secure your primary email
Change its password first, using a new one you do not use elsewhere. Check that the recovery email and phone number still belong to you.
-
02
End unfamiliar sessions
Review signed-in devices, sign out of sessions you do not recognise, and remove unknown devices from the account.
-
03
Check how access could return
Look for unexpected email forwarding rules, changed recovery details and linked apps you did not approve. Remove access you cannot identify.
-
04
Contact your bank if needed
Report suspicious payments or possible banking access through your bank's official channel. Ask what to secure next and follow its instructions.
02 / Restore safely
A Structured Recovery Plan
Changing passwords alone may leave an attacker signed in. Recovery needs a clear sequence: remove access, protect the accounts that matter most, then check that recovery details are yours.
Order matters here.
2. Reset by priority
Start with email, banking and government-related accounts, then work through shopping and social accounts.
3. Rebuild sign-in security
Set up multi-factor authentication again. Add backup methods that do not rely only on the compromised email or phone.
4. Review and monitor
Check account activity and recovery details again. Keep watch for alerts, payment changes or fresh sign-in attempts.
03 / Leaked credentials
Exposed Passwords and Leaked Credentials
A password exposed on one site can put other accounts at risk if you reused it. Prioritise accounts that can reset other passwords or reveal personal and payment details.
Retire every reused version.
Osborne & Davies Digital Guard can help you make a practical reset order and review ways to reduce repeat account takeover. For ongoing personal security, see our personal cybersecurity guidance.
- Change the exposed password anywhere else you used it, beginning with email and financial accounts.
- Use a different, strong password for each account. A password manager can help you keep them organised.
- Turn on multi-factor authentication and choose a backup method you can still reach if your phone is unavailable.
- Treat dark-web monitoring as one source of alerts, not proof that every account is safe or exposed.
04 / Identity and money
Get guidance on identity theft recovery
Identity Theft and Fraudulent Applications
Unexpected credit checks, account opening messages or post about a service you did not request deserve attention. Keep the evidence and contact the organisation named in the notice through a verified channel.
Keep a clear record.
Spot unfamiliar activity
Save letters, emails and reference numbers linked to an application or account you did not make. Check the details with the organisation directly.
Protect key information
Store identity documents and account references securely. Avoid sending copies or personal details in response to an unexpected message.
Check more than alerts
Review account notices, credit activity and post. An alert can help, but it cannot replace checking with the relevant provider.
05 / Phone and account checks
SIM-Swap Concerns and Ongoing Checks
Your mobile number can be used to receive account recovery codes. If phone service suddenly stops without explanation, contact your mobile provider promptly using another phone or its verified website.
Take a sudden signal loss seriously.
- Ask your mobile provider to check for an unauthorised SIM or number transfer.
- Use a second recovery method on important accounts where the provider offers one.
- Every few weeks, review signed-in devices, linked apps and account recovery details.
06 / Common questions
Breach Questions People Ask Most
You do not need to diagnose the whole incident before asking for help.
How can I tell whether someone accessed my account?
Look for sign-in alerts, devices or locations you do not recognise, changed recovery details, messages you did not send, and rules or purchases you did not create. Alerts can be delayed, so check the account's own security activity as well.
Should I close the account or try to recover it?
Use the provider's official recovery route first, unless the provider or your bank tells you to close or freeze something. Secure the email address that controls recovery and contact the bank directly if financial access may be involved.
What if the attacker changed my recovery email or phone number?
Use the service's official compromised-account process from a device you trust. Contact the provider through its verified support route and explain which recovery details changed. Do not share passwords or one-time codes with anyone who contacts you.
How long does account recovery usually take?
It depends on the provider, the checks it needs and whether you can still access a trusted recovery method. Some accounts can be secured quickly; others need a review by the provider. Keep case references and follow-up dates together.
Need a person now?
Get Help While It Still Matters
Tell us which account is affected, what changed and what you have already tried. We will help you set the next priority without asking you to disclose your password or security codes.