Take a state-sponsored hacking alert seriously, but do not treat it as proof that an attacker got into your account—or proof of who was behind an attempt. Use the provider’s official recovery and security-check process to look for evidence, remove unfamiliar access, and strengthen sign-in and recovery options. If a work or government account may be involved, contact its security or IT team promptly.
First, distinguish a warning from a confirmed compromise
A provider may warn that your account was targeted or that it detected suspicious activity. That warning is important, but it does not by itself establish that anyone signed in, changed settings, or accessed your information. Nor does an alert alone prove who sent an attack. Check the account’s own recent security activity and settings before drawing conclusions.
- Targeting notification: A provider says it believes someone targeted your account. Treat it as a reason to review security, not as confirmation of a successful login.
- Attempted or suspicious access: The account shows an unfamiliar sign-in attempt or security event. Review the event and the account’s current access and recovery settings.
- Evidence of compromise: You find an unfamiliar successful sign-in, a changed recovery method, an unknown authentication factor, or account settings you did not change. Follow the recovery steps below and treat the account as compromised.
Provider help pages distinguish suspicious activity and sign-in notifications from the account actions users can inspect. A threat notification warrants prompt action, but it is not an attribution report.
As an Amazon Associate I earn from qualifying purchases.
Secure the account in this order
- Go to the provider directly. Open its known official website or app yourself; do not use links in an unexpected alert. If the device you normally use may be compromised, use another device you trust for account recovery. This is a cautious operational step, not a universal device-cleanup procedure.
- Recover access through the official process. If you are locked out, use the provider’s account-recovery flow. Do not rely on instructions from someone who contacts you unexpectedly and claims to be support.
- Inspect security activity and account settings. Check recent security activity, alerts, signed-in devices, sign-in methods, and recovery email addresses or phone numbers. Look for changes you do not recognize. Google’s compromised-account guidance also recommends checking Gmail settings for unfamiliar changes, such as unexpected forwarding or filters.
- Remove access you do not recognize. Follow the provider’s instructions to remove unfamiliar sign-in methods or recovery options and revoke unknown sessions or devices where that control is available. Google advises removing an unrecognized at-risk sign-in method, then changing the password and reviewing security settings.
- Change the password. Set a new, unique password for the affected account. If you reused its old password anywhere else, change those passwords too—especially on the email account used to recover it. CISA’s state-sponsored threat guidance recommends strong passwords that are not reused across accounts.
- Check email rules and linked accounts. In email settings, look for forwarding addresses, filters, or other rules you did not create. Review important linked accounts, especially the recovery email account, because access to it can undermine recovery for other services.
- Strengthen sign-in and recovery. Enable the strongest multifactor authentication (MFA) the provider supports, preferably a phishing-resistant passkey or physical security key when available. Confirm your recovery details are still yours, save recovery codes securely if offered, and keep a backup way to regain access.
Exact menus, session controls, and recovery options differ by provider and can change. Use the provider’s current official instructions rather than assuming another service has the same controls.
Choose MFA with recovery in mind
Passkeys and physical security keys can provide phishing-resistant sign-in, but the right choice depends on what your account supports and how you will recover access if a device or key is lost.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Option | What to check | Recovery consideration |
|---|---|---|
| Passkey | Confirm the provider supports passkeys for your account and understand where yours will be stored, such as on a device or in a password manager. | Microsoft warns that losing a device can mean losing its passkey unless another recovery method exists. Keep a separate recovery route. |
| Physical security key | Confirm the provider supports the key. Google describes security keys as its most secure listed verification step; CISA identifies them as a physical MFA option. | Consider how you will sign in if the key is lost. Keep a backup factor or recovery method, and store any spare key safely. |
A security key is an optional tool, not a substitute for removing an attacker’s existing access, reviewing account settings, or recovering a compromised account. Do not add a factor until you have checked that the account and your recovery plan support it.
If a work or government account may be involved
Contact your organization’s security or IT response team promptly and follow its incident process. Work, government, and managed accounts may be governed by controls that individual users cannot see; do not attempt broad containment or enterprise-wide changes based on consumer account instructions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
CISA’s Emergency Directive 24-02 followed a state-sponsored compromise of Microsoft corporate email. The directive required affected Federal Civilian Executive Branch (FCEB) agencies to investigate exposed content, reset credentials, and secure privileged accounts. Those requirements applied to the affected federal agencies, not to every personal account. In its April 11, 2024 alert, CISA said: “Regardless of direct impact, all organizations are strongly encouraged to apply stringent security measures, including strong passwords, multifactor authentication (MFA) and prohibited sharing of unprotected sensitive information via unsecure channels.” CISA advised potentially affected other organizations to contact Microsoft.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep records and decide whether to escalate
Keep the original alert, its timestamp, provider notifications, and relevant sign-in information. If an organization is responding, avoid deleting evidence or making sweeping device or network changes before its responders advise you. CISA’s 2025 network advisory recommends that organizations attempt to identify the full scope of a suspected compromise before mitigation; that is enterprise technical guidance, not a home-user forensic checklist.
Ask the provider for help if you cannot recover access. Contact your organization if a managed account or work system may be affected. If financial fraud is underway, contact the relevant bank or financial provider promptly. If sensitive information or safety is at stake, seek appropriate specialist or local-authority help. Which forensic service or reporting route is appropriate depends on the circumstances; an alert alone is not enough to determine that.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
