What to Do in the First 60 Minutes After You Think You've Been Hacked

You notice something wrong: strange pop-ups, files you didn't create, an email you didn't send, or a password that suddenly doesn't work. Your stomach drops. You might have been hacked. Here's exactly what to do in the next 60 minutes.

Minutes 0-5: Don't Panic, Disconnect

Disconnect the affected device from the internet immediately. Unplug the ethernet cable or turn off WiFi. This stops the attacker from accessing your system remotely and prevents malware from spreading to other devices on your network. Do NOT turn off the computer yet.

Minutes 5-15: Document Everything

Take photos of any error messages or suspicious activity on your screen with your phone. Note the exact time you noticed the issue. Write down what you were doing right before: Did you click a link? Download a file? Enter credentials somewhere?

Minutes 15-30: Change Critical Passwords

Using a DIFFERENT device (your phone or another computer), change passwords for your most critical accounts: email, banking, and any account that uses the same password as the compromised one. Enable MFA on every account that supports it.

Minutes 30-45: Alert Your Team

If this is a work device, notify your IT team or managed service provider immediately. If you're a OneClickIT customer, open a ticket or call our emergency line. The faster professionals can investigate, the less damage occurs.

Minutes 45-60: Preserve Evidence

Don't try to "clean up" the compromised device yourself. Security professionals need to examine it to understand what happened, what data may have been accessed, and whether other systems are affected. Leave the device disconnected but powered on.