Recommended Free Tools
If you suspect a cyberattack, alert the responsible security or IT lead through a trusted channel, contain affected systems, and preserve useful evidence before destructive cleanup when feasible. Then close compromised access, report through appropriate channels, and restore only after systems have been checked. The right steps differ for a personal account, a home device, an organization-wide intrusion, and exposed personal information.
First, identify what was affected and who controls it
Use this distinction to choose the right response path. If you are unsure whether a device or account belongs to an organization’s network, contact its IT or security team rather than trying to investigate or clean it yourself.
As an Amazon Associate I earn from qualifying purchases.
| Situation | Who should lead | Immediate priority |
|---|---|---|
| A personal email or social account was taken over | You, using the service’s official recovery process | Regain access, remove unauthorized access, and secure accounts that reused the password |
| A personal device may have malware | You, with help from the device maker or a trusted security professional if needed | Limit network exposure; avoid wiping or powering off automatically if evidence may matter |
| An organization’s systems are affected, especially by ransomware | The organization’s incident-response lead, security or IT team, and relevant specialists | Isolate affected systems, preserve evidence, and coordinate containment and recovery |
| Personal information was exposed, but no account takeover is known | You, following steps tailored to the exposed information | Check for identity misuse and take appropriate protective steps |
What should I do first after a cyberattack?
- Alert the right responder over a trusted channel. For a work or school system, activate the incident-response plan and notify the designated security or IT lead. The organization may also need to notify executives, its managed security provider, and its insurer. For a personal account, go directly to the service’s known official website, app, or phone number; do not follow recovery links in an unexpected email or text.
- Contain the affected system or account. For an organization, identify affected devices and isolate them from the network as quickly as feasible. If several systems or network segments are involved, the response team may need to disconnect them at a network switch. For an individual device, disconnecting Wi-Fi or its network cable may limit further communication, but get help if you are uncertain what is affected.
- Preserve evidence before destructive cleanup when feasible. Tell the incident lead or responder what happened and when. Keep relevant logs, messages, timestamps, and notes. In an organizational incident, a qualified responder may need to capture system images, memory, or logs, especially when evidence is volatile or has short retention. Coordinate with that responder or law enforcement before wiping, deleting files, or reimaging a device.
- Close routes the attacker may still be using. Identify affected accounts and revoke or reset exposed credentials. For organizations, review user and service accounts, certificates, other secret credentials, remote access, and cloud access. For personal accounts, use the provider’s recovery process and inspect active sessions, recovery email addresses and phone numbers, and connected apps.
- Report through appropriate channels and determine whether notice is required. The applicable law, contract, and incident plan depend on jurisdiction, sector, incident type, and data affected. There is no single reporting deadline that applies safely to every incident.
- Restore only after containment and validation. Confirm that compromised systems and access paths have been addressed before reconnecting systems or restoring data. For ransomware, use clean offline, encrypted backups where available and prioritize essential services.
The current NIST incident-response guide is SP 800-61 Revision 3, finalized on April 3, 2025; it supersedes Revision 2 and integrates incident response with the NIST Cybersecurity Framework 2.0. NIST says, “Incident response is a critical part of cybersecurity risk management and should be integrated across organizational operations.”
Should I turn off my computer after a cyberattack?
Not automatically. The right action depends on what is affected and whether immediate containment or evidence preservation is the priority. For an organization, follow the incident lead’s instructions: isolate affected systems, but coordinate before powering them off or wiping them because volatile evidence may be lost. CISA recommends capturing system images, memory, and relevant logs when immediate mitigation is not possible.
#1 Best Overall
If it is your personal device and you suspect malware, disconnecting it from Wi-Fi or its network cable can limit network access while you seek help from the device maker or a trusted security professional. Do not assume a scan proves an organization’s network is safe, and do not treat a personal-device cleanup as a substitute for organizational incident response.
What should I do if my email or social account was hacked?
If you can still sign in, use the service’s official security settings and recovery guidance. The FTC’s hacked-account guide recommends taking these steps after access is restored:
- Change the account password, and change it on any other account where you reused it.
- Sign out of all devices and review account activity for unfamiliar access.
- Check recovery email addresses and phone numbers, and remove details you did not add.
- Review connected apps and revoke access you do not recognize.
- Turn on two-factor authentication where available, and alert contacts if the attacker may have sent messages from your account.
If you cannot log in, use the provider’s official account-recovery instructions. Do not trust a recovery service or phone number sent to you by someone claiming to be the attacker or support staff.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen changing the password is not enough
Some attacks can leave access in place through an app authorization token, which a password change alone may not revoke. In its September 1, 2026 advisory on consent phishing, the FBI’s Internet Crime Complaint Center (IC3) advises victims of that specific technique to remove unauthorized app access in their account’s security settings. Review app permissions when securing an account, but do not assume every account takeover uses this method.
Rank #3
What should I do after a data breach?
Start by finding out what information was exposed, if that is known, and use the FTC’s data-breach guidance or IdentityTheft.gov/databreach for steps tailored to that information. If a Social Security number was exposed, for example, the FTC suggests ordering credit reports and checking for unfamiliar accounts. A fraud alert or credit freeze may help make it harder for someone to open new accounts in your name. If identity theft is already occurring, report it through IdentityTheft.gov and follow its recovery plan.
How do I report a cyberattack?
For a US cybercrime, you can file a detailed complaint with IC3. Its data-breach guidance advises organizations to quarantine or take affected hosts offline, reset or revoke exposed credentials, and reimage compromised hosts unless forensic preservation is requested. Include what happened, relevant communications, timestamps, suspicious messages, and available logs. A report may be referred to law enforcement, but referral and follow-up are at agency discretion; filing one does not guarantee an investigation or a response.
For ransomware affecting an organization, CISA’s ransomware guidance recommends considering contact with CISA, a local FBI field office, IC3, or a local US Secret Service office. Follow your organization’s response plan and get legal advice about any required breach notices. For personal incidents, report to the affected service through its official contact channel; if money was transferred fraudulently, contact the financial institution immediately using contact details you find independently, then report to IC3.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow should an organization recover safely?
Restore in a controlled order
Do not reconnect or restore systems simply because a backup exists. First establish that the affected systems are contained and that the compromised access paths have been addressed. Then restore from clean backups, prioritizing critical services and checking restored systems before returning them to normal use. CISA recommends offline, encrypted backups for ransomware recovery and warns organizations to avoid reintroducing compromised systems.
Best Value
Document the response and update the plan
Keep an incident timeline, record decisions and actions, and preserve relevant communications and logs. After recovery, review what happened and update response plans and safeguards so the organization can respond more effectively next time. NIST’s current incident-response project describes the integration of response into broader cybersecurity risk management.
Quick Recap
What not to assume
- Paying a ransom does not guarantee that data will be restored.
- A consumer malware scan does not establish that an organization’s network is clean.
- Every incident does not have to be reported to the same agency.
- One legal reporting deadline does not apply to every person, organization, or breach.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
