You will find out one of three ways. A follower messages you about a livestream you did not start. A login alert arrives from a city you have never visited. Or you simply cannot get in, and the recovery email is no longer yours.

The next hour matters more than the next week. Not because speed alone fixes it, but because the mistakes people make in the first hour are the ones that make recovery take months. Here is the order of operations.

Minute 0 to 10: Secure the email first

Your email account is the master key. Every platform resets its password through it. If the attacker holds your email, nothing else you do will stick, because they will simply reset it again.

Go to your primary email account on a device you trust. If you can still log in, change the password immediately to something long and new. Turn on two-factor authentication if it is not on, or switch it to an authenticator app or hardware key if it is currently SMS. Then check three things attackers nearly always change: the recovery email, the recovery phone number, and forwarding rules or filters. Remove anything you do not recognize.

If you cannot log into your email, start that provider’s account recovery process now, before anything else. Everything downstream depends on it.

Minute 10 to 20: Revoke every session

Changing a password does not log out existing sessions on most platforms. The attacker may still be sitting inside your account on their own device. Every major service has a page listing active sessions and connected devices. Sign out of everything you do not recognize, then sign out of everything, period. You can log back in.

Do this for your email, then for the compromised platform, then for the other platforms that share the same recovery email. Assume the attacker tried them all.

While you are there, review connected third-party apps and remove anything you did not add. A rogue OAuth connection is a quiet way to keep access after a password change.

Minute 20 to 30: Document everything

Before you make more changes, capture evidence. Screenshot the login alerts, the unfamiliar sessions, the changed profile, the posts or streams the attacker put up, and any messages they sent to your audience. Note the timestamps and the time zone. Save the phishing email if there was one, including the full headers.

Platforms and law enforcement will ask for this. So will your insurance carrier, if you have coverage. So will the brand whose campaign was mid-flight. Evidence collected now is clean. Evidence reconstructed later is argued over.

Minute 30 to 45: Start the platform process, carefully

Every platform has an account recovery flow for hacked accounts. Use the official one, reached by typing the platform’s URL yourself, not through a link anyone sends you.

Here is the part people get wrong. These processes are rate-limited and tracked. If you submit five appeals in an hour with inconsistent details, you can push your case into a queue that nobody reads, or trigger an automatic denial. If the account has been disabled rather than just hijacked, the appeal window is finite. Instagram’s disabled-account appeal window can close in as little as 30 days. You do not get to burn attempts and try again later.

Submit one appeal. Make it accurate and complete. Use the original email and phone on the account, not the new ones the attacker added. Then wait for the response before submitting another.

Minute 45 to 60: Notify the right people

  • Your manager, agency, or business partner, so they can stop campaigns and field brand questions.
  • Your audience, through whatever channel you still control, with a short, plain message: the account is compromised, do not click links or send money, updates to follow.
  • Any brand with a live campaign on the affected account.
  • Your bank and payment processors if any financial account shares a password or recovery email with the compromised one.
  • Law enforcement. In the United States, file a report with the FBI’s Internet Crime Complaint Center at ic3.gov. It will not get your account back today, but the report number is useful with platforms and insurers.

What not to do

Do not pay anyone who appears in your comments or DMs offering to recover your account. The “recovery experts” who show up within minutes of a public hack are a second scam feeding on the first. No legitimate recovery process begins with a stranger contacting you.

Do not pay the attacker. Ransom demands for creator accounts are common and the account is rarely returned. You are funding the next campaign.

Do not reuse the compromised password anywhere, and do not set a new one that is a variation of the old one.

Do not keep using the device the compromise may have come from. If you opened an attachment or ran a file in the days before the takeover, that machine is suspect until it is wiped. Logging into your freshly secured accounts from an infected laptop hands them back.

Do not go quiet. Silence lets the attacker speak with your voice to your audience. A single honest post stops a lot of downstream fraud.

After the first hour

Rotate every password that shared the compromised recovery email. Move two-factor authentication off SMS everywhere. Check your carrier account for an unauthorized SIM change. Review who has access to your accounts and remove anyone who does not need it. And write down what happened, in order, while it is fresh. You will want that record.

Where ShutOut comes in

ShutOut’s incident response team runs this checklist with you in real time, handles evidence collection and platform escalation through established channels rather than public forms, and manages the appeal so it is filed once and filed correctly. Once the account is back, we harden it so the same door does not open twice, and keep monitoring for the follow-on impersonation accounts that almost always appear after a public takeover.