Treat a suspected stolen password or token as an incident to scope, not as a routine password-change request. Your plan should identify the affected identity, determine what it could reach, preserve evidence, contain access, remove persistence, recover in controlled stages, and document improvements. The same sequence works for a small company and can be scaled for a major compromise.
Build the plan before an incident. Assign decision-makers, retain usable logs, define emergency authority, and test your communication paths. During an incident, use the sequence below: preparation; detection and analysis; containment; eradication; recovery; and post-incident review.
As an Amazon Associate I earn from qualifying purchases.
What a stolen-credential response plan must accomplish
A credential can be a password, session cookie, API key, recovery code, private key, or other authenticator. If an attacker obtains one, changing the password may not be enough. The identity may have active sessions, delegated access, mailbox rules, cloud tokens, administrative privileges, or access to other systems.
CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (2024) are written for Federal Civilian Executive Branch agencies and certain serious incidents. CISA also says the broader response practices are useful to public and private organizations. Use the playbook’s lifecycle as a planning model, but adapt authorities, notification duties, system dependencies, and technical steps to your organization.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CISA’s 2018 credential-access alert states: “Compromised account credentials continue to be the number one way threat actors are able to penetrate a network environment.” That is an attributed statement from a 2018 alert, not a current measured statistic. The practical implication is that every suspected compromise deserves structured scoping.
Define roles and authority before anything happens
A response slows down when nobody knows who can disable an account, isolate a laptop, contact a customer, or approve an emergency vendor. Name a primary incident lead and at least one backup. Record their out-of-band contact details in a location that remains available if your normal email or collaboration system is compromised.
Core response roles
- Incident lead: sets priorities, declares severity, maintains the timeline, and approves containment and recovery gates.
- Identity and infrastructure lead: works with the identity provider, email, remote-access, cloud, endpoint, and network owners.
- Evidence and investigation lead: preserves logs and artifacts, establishes the time window, and coordinates analysis.
- Communications lead: prepares employee, customer, partner, regulator, and media messages with approved facts.
- Legal and privacy adviser: assesses contractual, regulatory, employment, and notification obligations.
- Business-continuity owner: identifies essential processes and approves operational trade-offs.
- Executive decision-maker: resolves risk, budget, and service-availability decisions when impact is material.
These roles can be combined in a small organization, but the responsibilities still need named owners. CISA’s logging guidance recommends a crisis-response team with technology, communications, legal, and business-continuity representation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Write emergency authorities into the plan
Specify who may disable an account, revoke access, force a sign-out, isolate a device, block an indicator, suspend an integration, reset credentials, engage outside incident-response support, and restore a service. Define an escalation path when the usual approver is unavailable. Include a requirement to record who authorized each disruptive action and when.
Prepare the visibility and contact list you will need
Preparation determines whether you can answer basic questions such as “When did the attacker first sign in?” and “What did this account change?” Inventory every place the identity can authenticate or be trusted:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Identity provider, directory, single sign-on, and privileged-access systems.
- Email, file storage, collaboration, source-control, finance, human-resources, and customer systems.
- Virtual private network, remote-desktop, administrative portals, and other remote-access services.
- Endpoints, servers, cloud workloads, network devices, backup systems, and security tooling.
- Applications that use service accounts, API keys, OAuth grants, certificates, or delegated permissions.
- Business owners and after-hours contacts for each critical system.
Enable and protect the right logs
CISA identifies user activity, administrator actions, network traffic, application logins, and system events as relevant logging categories. Enable them where possible, centralize copies, set retention that covers your likely investigation window, and restrict who can read or alter them. Protect logs against unauthorized access and deletion; an attacker who can erase evidence can also hide persistence.
At minimum, ensure you can retrieve authentication successes and failures, source addresses or device information, multifactor events, privilege changes, account-setting changes, mailbox-rule changes, token or key creation, and administrative actions. Alert on high-risk events such as repeated failed logins, impossible travel according to your platform’s capabilities, new privileged assignments, and sign-ins from unusual devices or locations. Test that alerts reach a person who can act.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMaintain a ready-to-use response kit
- Current identity-provider, email, endpoint, network, and cloud administration procedures.
- Offline or separately protected copies of critical contacts and escalation instructions.
- An incident timeline template with UTC timestamps, source, action, owner, and confidence.
- Evidence-handling instructions, including read-only exports, hashes where appropriate, and chain-of-custody ownership.
- Preapproved employee and customer communication drafts that do not speculate about scope.
- Contracts and contact details for qualified incident-response and digital-forensics specialists.
Detect the suspected compromise and record the first facts
Start a case as soon as credible evidence appears: a phishing report, an impossible sign-in, a leaked secret, an unexpected multifactor prompt, a new mailbox rule, an unfamiliar administrator, or a notice from a service provider. Preserve the original alert, message, screenshot, ticket, or report. Do not edit away useful details while forwarding it.
Record who reported the issue, when it was detected, which identity is suspected, what evidence triggered the report, and which systems or data that identity could reach. Note the time zone and use a consistent time standard for the timeline. Mark facts as confirmed, suspected, or unknown so assumptions do not become “known” during handoffs.
Initial triage questions
- Is the credential still usable, and is the legitimate user currently locked out or receiving unexpected prompts?
- Which identity, account type, device, application, key, token, or session is involved?
- Does the identity have administrative, financial, production, backup, or security-tool privileges?
- What systems, shared drives, mailboxes, APIs, and third parties trust this identity?
- What is the earliest suspicious event and the latest known activity?
- Is there evidence of persistence, privilege escalation, lateral movement, data access, or destructive action?
- Could the reporting channel itself be monitored or controlled by the attacker?
Do not wait for perfect certainty before taking proportionate containment. Conversely, do not destroy evidence by making broad changes without recording what you changed and why.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Contain access while preserving evidence
Containment stops further use while the team determines scope. Coordinate with the identity provider and each service owner, following your approved procedures. Depending on the evidence and business impact, actions may include disabling the identity, blocking a compromised key, suspending an integration, restricting sign-ins, isolating a suspected endpoint, or removing a malicious mailbox rule.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose containment scope deliberately
| Situation | Typical planning response | Operational consideration |
|---|---|---|
| Low-privilege user, one service, strong logs, no suspicious follow-on activity | Contain the identity and affected service; preserve relevant logs; investigate the defined time window. | Keep unrelated work operating while confirming that no connected access was used. |
| Privileged or administrator identity | Use emergency authority to contain the account and review related administrative identities, systems, and changes. | Expect wider impact and involve infrastructure, legal, and executive owners early. |
| Unknown scope, missing logs, or signs of lateral movement | Isolate implicated devices or systems as justified, protect evidence, and obtain specialist support if internal capacity is insufficient. | Document safety and availability consequences of every isolation decision. |
| Compromised API key, token, certificate, or delegated grant | Revoke or disable the credential through its issuing system and identify applications and data that used it. | Coordinate replacement and service continuity; a user-password reset will not address this credential type. |
A password reset alone does not prove containment. The plan should require responders to verify that the identity, active access paths, delegated permissions, and related privileged accounts are controlled. Exact session and token invalidation commands vary by identity platform; consult that platform’s current official documentation rather than assuming that changing a password terminates every session.
Preserve evidence before disruptive actions where feasible
CISA’s threat advisories recommend isolating affected systems while collecting and reviewing relevant logs, data, and artifacts. In practice, coordinate both objectives. Export authentication and administrator events, preserve suspicious messages and files, capture endpoint or cloud details your tools support, and record timestamps before rotating or deleting anything. If immediate safety requires isolation first, document that decision and preserve what remains.
Investigate the identity, access path, and blast radius
The investigation should establish what happened, how the credential was obtained if possible, what the attacker accessed, and whether another foothold remains. Review identity, email, application, endpoint, network, and administrator events available in your environment. Search from the earliest plausible compromise through the time of containment, then check for delayed activity.
Build an evidence timeline
- Identify the last known legitimate activity and the first suspicious event.
- Group sign-ins by source address, device, geography, application, authentication method, and result.
- Map privilege assignments, group changes, mailbox rules, forwarding settings, OAuth grants, API-key creation, and recovery-method changes.
- List files, records, mailboxes, repositories, systems, or databases the identity accessed or could access during the window.
- Compare activity with the user’s schedule, device inventory, travel, and approved changes.
- Search for the same indicators across other identities and systems, including service and administrator accounts.
Keep the original data protected from modification or deletion. Limit access to investigators and record exports, transformations, and interpretations. If logs are incomplete, state exactly what cannot be established; absence of evidence is not proof that no access occurred.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check for privilege changes and persistence
- Unexpected administrator or security-group membership.
- New local accounts, cloud identities, access keys, certificates, or recovery factors.
- New mailbox forwarding, inbox rules, delegated access, or application consent.
- Scheduled tasks, startup mechanisms, remote-management settings, or modified endpoint controls.
- Changes to backup, logging, alerting, firewall, or security-tool configurations.
- Reuse of the same password or secret in other services, if your evidence supports that possibility.
Prioritize connected systems according to privilege, sensitivity, and evidence of use. A compromised standard account with no suspicious activity in a well-logged single service is a different operational problem from a directory administrator whose token was used to alter multiple systems.
Eradicate the attacker’s access and remove persistence
Eradication is more than replacing the string that was stolen. Remove unauthorized accounts, grants, rules, keys, certificates, scheduled tasks, and configuration changes. Correct privilege assignments and restore security controls that were disabled. Reimage or rebuild an endpoint when your evidence and risk assessment indicate that cleaning it cannot establish trust.
For a significant compromise or suspected lateral movement, consider qualified external incident-response or digital-forensics support. CISA notes that specialist assistance can help ensure threat actors are eradicated and residual access does not remain. Engage help when the incident exceeds your staff’s investigative skill, available tooling, independence, or ability to preserve business operations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover in controlled stages
Reset confirmed exposed credentials and investigate scope before deciding whether additional accounts, administrative credentials, keys, or systems require action. CISA has directed credential resets in specific federal incidents and discusses broader account and key resets in the context of Windows Active Directory compromise. Those scenario-specific actions do not establish a universal rule to reset every password after every incident.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use a recovery gate
- Confirm that known malicious sessions, tokens, keys, grants, rules, accounts, and privilege changes are revoked or corrected.
- Reset the exposed credential through a trusted administrative path, not through a link or device supplied by the suspected attacker.
- Verify the user’s recovery methods, enrolled multifactor devices, contact details, and trusted devices.
- Apply the least privilege required for the user’s work and remove temporary emergency access when no longer needed.
- Restore systems or connectivity in an order agreed with business owners, starting with dependencies required for safe operations.
- Increase monitoring for renewed suspicious authentication, privilege changes, and access to the affected data.
- Have the incident lead and relevant system owner record the decision to restore service and any remaining uncertainty.
The reviewed CISA sources support recovery and continued monitoring but do not define one universal technical release criterion. Your organization must set the gate and document why it is satisfied.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Strengthen authentication and monitoring after recovery
CISA says multifactor authentication makes access harder even when a password is compromised and recommends phishing-resistant MFA in its credential guidance. It identifies security keys as a preferred option. Evaluate methods against phishing resistance, identity-provider and device compatibility, account-recovery procedures, key inventory, loss replacement, and support capacity. A security key is a preventive control for future authentication; it does not contain or reverse an incident that already occurred.
Adopt an organization-managed password manager where appropriate so employees can use unique passwords and administrators can enforce policy, offboarding, sharing, and recovery controls. A password manager supports prevention; it is not a substitute for incident scoping, logging, or response authority.
During the heightened-monitoring period, alert on unusual sign-ins, repeated multifactor prompts, new recovery methods, privilege changes, new tokens or keys, suspicious mailbox activity, and access from devices or locations inconsistent with the user’s role. Set an end date for heightened monitoring and document who reviews alerts.
Recommended Free Tools
Communicate without overstating what is known
Use one fact-checked timeline and a single communications owner. Tell the affected employee what action is required, how to contact support through a trusted channel, and what information not to share. Tell managers what work may be disrupted without exposing investigative details. Customer, partner, regulator, and law-enforcement notifications should be coordinated with legal and privacy advisers and based on confirmed facts and applicable obligations.
Do not announce that a breach occurred when you have only detected suspicious authentication. Conversely, do not describe an incident as harmless until you have assessed the identity’s privileges, connected systems, and available evidence. State what is known, what is being done, and when the next update will occur.
Document the post-incident review
Close the incident only after documenting the timeline, scope, impact, decisions, containment and recovery actions, evidence limitations, notifications, and remaining uncertainty. Preserve the case record according to your retention and legal requirements.
Turn findings into owned improvements
- Which logs were missing, delayed, inaccessible, or vulnerable to deletion?
- Could the team identify every service and device that trusted the credential?
- Did the organization have usable out-of-band contacts and emergency authority?
- Were privileged accounts separated, monitored, and protected by stronger authentication?
- Did password, token, key, and session revocation work as expected?
- Could employees report phishing or unexpected multifactor prompts quickly?
- Which changes have an owner, due date, priority, and verification method?
Retest the specific controls that failed. A tabletop exercise using the same identity provider, logging gaps, communication paths, and recovery decisions is more useful than a generic awareness presentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Common mistakes and safer alternatives
- Only changing the password: also investigate sessions, tokens, delegated grants, recovery methods, privilege changes, and connected systems.
- Resetting every password without scoping: assess evidence, trust boundaries, and operational consequences; broaden resets when the investigation justifies them.
- Disabling logging during a crisis: protect and centralize logs so they remain available for investigation.
- Isolating systems without recording why: document the authorizer, timestamp, expected effect, and business impact.
- Trusting the compromised email account for coordination: use an out-of-band channel for sensitive instructions.
- Assuming no alert means no access: account for retention gaps, disabled telemetry, and activity outside monitored services.
- Restoring service immediately after a reset: require a documented recovery gate and heightened monitoring.
- Waiting too long to obtain specialist help: escalate when scope, privilege, evidence, or internal capacity makes reliable eradication unlikely.
A concise incident checklist
- Declare a case, assign an incident lead, and open a UTC timeline.
- Preserve the original report, alert, message, and relevant evidence.
- Identify the credential, privilege level, services, devices, and data it could reach.
- Contact identity, email, endpoint, network, cloud, business, legal, and communications owners.
- Contain the identity and related access paths using approved procedures.
- Collect and protect identity, application, endpoint, network, and administrator logs.
- Search for privilege changes, persistence, lateral movement, and related accounts.
- Remove unauthorized access and decide whether specialist response support is needed.
- Reset confirmed exposed credentials and address other accounts or keys according to evidence and trust boundaries.
- Restore services through an organization-defined gate and monitor for recurrence.
- Document impact, uncertainty, notifications, and owned improvements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
