Email Hacked? 7 Immediate Steps You Need to Take RIGHT NOW

03:14 AM: The Real Case

You wake up, check your phone — “Unusual login attempt from Poland”. Two minutes later, a friend messages you on WhatsApp: “Why are you sending me weird crypto links in the middle of the night?”

What feels normal after a hack

Many victims report that an email hack feels like a personal attack. This is understandable — after all, your email is the key to almost everything: bank, social media, cloud, shopping.

But it’s important to know: In the vast majority of cases, “you” were not the target. Your account was automatically checked — along with thousands of others.

This means: It’s not about defending yourself against a single attacker now, but about clean damage control. This takes the panic out — and looks competent.

Your heart beats faster, panic sets in. But that’s exactly where the mistake lies. In 90% of cases, an email hack is not a targeted attack on you personally, but the result of an automated process. Now, what counts is not speed at any cost, but structure.

Don’t Panic: An email hack is unpleasant, but almost always controllable. With this plan, you’ll be secure again in 30-45 minutes.

Reality Check: What likely happened?

Before you delete everything, categorize the situation. Usually, it’s one of the following:

Your password was in an old data breach.
You used this password for multiple services.
A bot tested the credentials automatically (Credential Stuffing).

It usually DOES NOT mean: That a hacker is sitting live in front of their laptop watching you through your camera, or that your entire life is compromised. This differentiation helps you act calmly and precisely.

The 7 Steps to Security

Step 1: Change password — the right way

Don’t just “change” it. If you use Gmail, this is the direct path:

Profile picture > "Manage your Google Account" > Security > "Password"

Choose a password with 16+ characters that is absolutely unique.

Technical Background: Bots don’t “guess” passwords. They compare billions of leaked combinations from databases in milliseconds. A long, unique password makes this comparison value worthless for the attacker.

Step 2: Terminate active sessions

This is the point most people forget. A new password is useless if the hacker is still logged in (Session Hijacking).

Gmail: Security > "Your devices" > "Manage all devices" > Select unknown devices > "Sign out"

How to recognize suspicious sessions:

In the device overview you see:

Date and time of last activity
Device type (e.g., Windows PC, Android, iPhone)
Approximate location

Important: Some locations are inaccurate (e.g., “Netherlands” when using a VPN). The key is whether you were active yourself at that time. Anything you can’t clearly assign — sign out immediately.

Step 3: Check Forwarding & Filters

The “pro move” by attackers: They set up an invisible forwarding rule. This way, they continue to receive copies of all future emails (e.g., password resets from banks) without you noticing.

Gmail: Settings (gear icon) > See all settings > "Forwarding and POP/IMAP" > Remove any unknown addresses.

Additionally, check “Filters and Blocked Addresses” to see if emails from PayPal or banks are being automatically deleted.

Why password reuse is so dangerous

Attackers use so-called “Combo Lists”. These are huge text files with millions of email/password combinations from previous leaks.

These lists are automatically tested against known services — often with thousands of attempts per minute (Credential Stuffing).

If you used the same password at an old forum and for Gmail, a single leak is enough to endanger both accounts.

Step 4: Enable 2FA (but safely)

Two-factor authentication prevents 99% of all automated attacks. But beware: avoid SMS if possible. SMS can be intercepted via “SIM swapping.”

Instead, use an authenticator app (e.g., Google Authenticator or Bitwarden).

Which 2FA method makes realistic sense?

For most users, an authenticator app is the best balance of security and everyday usability.

Hardware keys (e.g., YubiKey) are even more secure, but impractical for many in everyday life.

You should only use SMS if no other option exists — especially if you have publicly stored your mobile number with many services. This is a differentiated recommendation, not marketing.

Step 5: Prioritize critical accounts

Don’t try to save everything at once. Work your way through this priority:

Bank & PayPal (Prevent financial damage)
Amazon (Credit card data stored)
Apple / Google (Access to cloud & photos)
Social Media (Identity theft)

Step 6: Inform contacts — minimalist

Not dramatic, not apologetic. A short, factual message is enough: “My account was briefly compromised. If you received any strange links from me: Please ignore and don’t click. Everything’s secure again.”

Step 7: Check leak cause

This is where our tool comes in. It’s no use changing your password if you don’t know where the leak came from.

Was your email found in a data breach? Check for free and anonymously which services have lost your data.

Check Now

Typical Mistakes After a Hack

We see the following oversights time and again in practice. They lead to accounts being taken over again days later:

Incomplete Securing — Only securing the email, but leaving the same password at Amazon or PayPal.
Leaving Sessions Open — Changing the password but not forcibly signing out “active devices” in the settings.
Convenience Trap — Only slightly varying the password (e.g., from “Summer2025!” to “Summer2026!”). Bots test these patterns first.
False Trust in SMS — Relying on SMS-2FA and believing the account is “unhackable.”

Prevention Without Marketing Hype

If you have more than ten different accounts, it’s factually impossible to remember a secure, complex password for every service. A password manager is therefore not a “nice-to-have” but the only realistic solution to avoid falling into the credential stuffing trap again.

The most common reason for account takeovers is password reuse. A password manager solves this problem systematically.

To Password Manager Comparison

How Hackers Actually Get Your Password

Knowledge is the best protection against fear. There are four main ways criminals take over accounts:

1. Large Data Breaches — A service (e.g., an old forum or a small shop) where you were active years ago is hacked. The database ends up on the web.

Why old leaks are still dangerous years later: Many data leaks only become public months or years later. Often old data sets reappear when they are resold or newly bundled. Even if a leak is from 2018, it can still be used for credential stuffing in 2026 — especially if passwords have never been changed.

2. Credential Stuffing — Attackers take the email and password from a previous leak and try this combination automatically with Gmail, PayPal, etc.

3. Phishing — You receive a deceptively real email from “Google” asking you to log in. However, the login page belongs to the hacker.

4. Stealer Logs (Malware) — A small file attached to an email installs a “keylogger.” This records every keystroke on your PC.

Frequently Asked Questions (Emergency FAQ)

Should I report it to the police?

For a pure email hack without financial damage, this is often not legally necessary, but useful for documentation. As soon as accounts have been charged (PayPal, bank) or there is identity theft, you should definitely go to the police.

Can the hacker see my cloud photos?

If the hacker had full access to your Google or Apple account, theoretically yes. This is why terminating active sessions (Step 2) is so critical.

Can I recover deleted emails?

Attackers often delete the entire inbox. In Gmail, you can check the “Trash.” If emails were deleted there too, Google offers a “Message Recovery Tool” that may be able to retrieve emails from the last 30 days.

Calm + Competence

An email hack feels like a break-in to your home. But with structure instead of panic, you regain control. Once the account is secure, you should find the cause with a cool head.

Start Breach Check Now

Mini-Checklist: 30-Minute Emergency Plan

If you only have 30 minutes, then in this order:

Change password
Sign out all sessions
Activate 2FA
Check Bank & PayPal
Control forwarding

Everything else you can do calmly afterwards.