The moment a friend asks why you are suddenly selling cheap skins in their DMs, the clock starts. The good news: the first hour has a fixed order, and panic is not one of the steps.
The short answer
What do you do in the first hour after an account is hacked? Move to a device you trust, secure your email account first, end all active sessions, then change your passwords in one go and check forwarding rules, recovery details and connected apps [1][2]. If you are locked out, use the provider's own recovery route instead of looking for shortcuts [2][8][10]. Our assessment: the order matters more than speed, because a stolen login session or a mail forwarding rule can survive a new password. This guide covers the technical first aid as of 25 Oct 2026. It is not legal advice; for a criminal complaint, disputed bills or liability, the police, a consumer advice centre or a lawyer are the right contacts [1][2].
How it works
- Switch to a clean device first. If you type a new password on a machine that runs malware, you hand it over a second time. The Verbraucherzentrale advises trying the sign-in from another device and doing the next steps there, so new user names and passwords cannot be intercepted [2]. Steam asks you to run virus and spyware scanners before you reset your password [12], and Microsoft asks for a full scan before the password change [9]. The BSI is stricter: if a scanner finds malware, it has to be removed first, because only then do the attackers lose access [1]. For a suspected infostealer, the BSI says to disconnect the computer from the internet at once [3]. After a confirmed infection it recommends reinstalling the operating system and changing the passwords of all online accounts afterwards [5]. Its ten-step guide uses a rescue medium that you download on a different, clean computer [4]. In practice, the clean device is often your phone with current updates, or a second PC that nobody in the household has used for "free" downloads.
- Secure your email account before anything else. Most other accounts can be reset through your inbox. The BSI says to start with the login data of the affected email account, so it can no longer be used to reset other passwords [1]. Steam notes that its accounts are commonly compromised after the linked email address is compromised [12]. If you still have access: change the password, end all sessions, then check the recovery phone number and recovery address [1][8]. Check forwarding and filter rules too, because a hidden forward keeps sending your reset mails to the attacker [1][2]. Google lists further settings to correct, among them mail delegation, automatic forwarding, scheduled emails and the vacation responder [8]. Apple adds a step that is easy to miss: ask your email provider and your mobile carrier whether you still control every address and number linked to the account, including whether SMS forwarding was set up [11]. Microsoft writes that it resets some settings after a takeover and asks you to check connected accounts, forwarding and automatic replies [9].
- If you are locked out, use the provider's recovery. Google sends you to its account recovery page [8]. Microsoft offers a Sign-in helper and a recovery form; it answers within 24 hours and accepts up to two attempts per day [10]. Microsoft also states plainly that it cannot help if two-step verification is on and you have lost every alternative method, and that its agents never send password reset links [10]. Apple starts recovery at iforgot.apple.com, followed by a waiting period [11]. The Verbraucherzentrale explains a common reason for a full lockout: most likely the attackers have switched on two-factor authentication themselves. Only the company can then restore access after checking your identity, and if that fails, the account is lost for good [2]. Be wary of helpers who find you first: Discord states that its staff never contact users directly through the app for support matters [14].
- End every active session. This is the step that many guides skip. Google describes cookie theft by malware: it happens after the login, so it bypasses two-factor authentication and other checks at sign-in, and stolen cookies keep working even after the malware has been found and removed [6]. In April 2026 Google added that infostealer families such as LummaC2 harvest session cookies, and that long cookie lifetimes let attackers into accounts without ever needing the password [7]. The BSI describes the infostealer StealC in the same terms: it reads saved passwords, cookies and autofill data from browsers and targets email programs, messengers and gaming platforms [3]. So after the device is clean, sign out everywhere. For email accounts, the BSI notes that you can usually end all sessions with one click in the settings [1]. At Google you open the device list under "Your devices" and remove entries you do not recognise [8]. At Apple you remove unknown devices on account.apple.com [11]. Google is rolling out a defence called Device Bound Session Credentials, available for Windows users from Chrome 146, which ties sessions to the device [7]. It only helps where a site supports it, so ending sessions stays your job.
- Change passwords in one go. The BSI says to work in one pass so attackers cannot get ahead of you, starting with the email account [1]. Then come all accounts that share the old password or use the hacked address for resets [1]. Google's list is a good template: sites with the same password, sites that contact you at that address, sites where you sign in with it, and passwords saved in your Google Account [8]. Every account gets its own password from now on [1]. A password manager makes that realistic.
- Check connected apps, keys and money. Attackers like to leave a back door that survives a password change. The BSI asks you to check which applications use your email account for single sign-on and whether new ones were added [1]. Discord tells you to deauthorize unknown entries under Authorized Apps [14]. Google tells you to uninstall Chrome extensions you do not recognise [8]. Valve documents that every use of the Steam Web API requires a key that you request through a form [13]. Our assessment, not a Valve instruction: if you never requested a key and one appears in your account, treat it as part of the takeover and revoke it. For money, the Verbraucherzentrale advises checking the order history, asking the shop to lock the account, contacting your bank and, if in doubt, blocking cards through the 116 116 hotline [2]. Discord warns that a chargeback through your bank can lead to the account being suspended while it investigates, and points to its billing team for refunds [14].
- Warn people, document, report. Tell your contacts that messages from your account may not come from you [1][2]. Take screenshots of changed settings, strange messages and charges before you clean them up. The police Onlinewache takes complaints for misuse of data or customer accounts; if the crime happened on the internet, you choose the federal state where you live, and you can upload screenshots [20]. The Verbraucherzentrale also names the victim support line of WEISSER RING (116 006) [2]. The BSI says it cannot give legal recommendations and suggests considering a lawyer if dunning letters arrive by post [1].
Where to go at the big providers
| Provider | Still signed in | Locked out |
|---|---|---|
| Review security events and devices, fix recovery data and Gmail forwarding [8] | Account recovery page [8] | |
| Microsoft | Scan, change password, check forwarding and auto-replies [9] | Sign-in helper, recovery form, answer within 24 hours [10] |
| Apple | Change password, remove unknown devices, check mail and phone numbers [11] | iforgot.apple.com with waiting period [11] |
| Steam | Scan, secure the email, then change the Steam password [12] | Steam Support [12] |
| Discord | Reset password, check MFA, remove Authorized Apps [14] | Ticket at dis.gd/hackedaccount [14] |
| Epic Games | Reset email and Epic password [16] | Recovery request, outcome within 48 hours or a note that it needs longer [16][17] |
After the first hour: check for leaks
Have I Been Pwned indexes so-called stealer logs, the output of malware that collects email addresses, passwords and the sites they were typed into [18]. After you verify your address through its free notification service, you can see which website domains appear next to it [19]. Two caveats from the operator: criminals produce this data without any guarantee of accuracy [19], and an address that is not found is not proof that it is safe [18]. The BSI also points to the leak checkers of the University of Bonn and the Hasso Plattner Institute [1]. Once things are calm, protect the accounts properly. Discord's backup codes, for example, work once each, so generate new ones after you are back in [15].
A worked example
This is an invented case, not a report on a real person. Jonas installs a "free cheat" for a shooter. Two days later his friends receive Discord messages with a link from his account, and Steam mails him that his email address has changed. Minute 0 to 10: he unplugs the gaming PC, which matches the BSI advice for infostealers [3], and continues on his updated phone. Minute 10 to 25: he changes the password of his mail account, ends all sessions there, deletes a forwarding rule he never created and corrects the recovery number [1][8]. Minute 25 to 40: on Discord he resets the password, checks MFA and removes two unknown Authorized Apps; because the attacker changed the Steam email, he opens a request with Steam Support [12][14]. Minute 40 to 60: he changes the passwords of every account that used the same one, warns his friends and takes screenshots for a complaint at the Onlinewache [1][20]. The gaming PC is reinstalled the next day, and only then does he sign in there again [4][5]. Every timestamp in this example is made up. Your first hour may take longer, and that is fine.
Checklist
- Switch to a device you trust and disconnect the suspect PC from the internet.
- Change your email password first and end all sessions of the mail account.
- Check recovery phone, recovery address, forwarding and filter rules, and fix anything you did not set.
- Use the provider's recovery page if you are locked out, and ignore anyone who messages you offering a "recovery".
- Sign out of every service once the device is clean, so stolen session cookies stop working.
- Change every password that matched the old one or depends on the hacked address.
- Remove unknown connected apps, browser extensions and API keys, and check payments.
- Warn your contacts, keep screenshots and file a complaint at the Onlinewache if you want to report it.
- Reinstall an infected PC before you sign in on it again.
Related pages: Passkeys and 2FA: secure your accounts; Self-hosting a password manager: 3 options; TOTP one-time codes; Passkey (FIDO2 sign-in); Router security checklist for home networks.