Hacked on X (Twitter)

Your X (Twitter) was taken. Here's the next hour.

X compromises are usually a reused password or a connected app. Both are fixable in minutes.

Does this look familiar

  • Posts, likes or follows you didn't make, often crypto
  • DMs sent from you to your followers
  • Password reset emails you didn't request
  • Login notifications from unknown locations
  • Your display name or avatar changed

Do these, in order

  1. Email and carrier first

    Before touching X (Twitter): from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.

  2. Request a password reset to your email or phone. If those were changed, use the account access form and give the exact handle, previous email and the approximate date you lost access.

  3. Once in: Settings → Security and account access → Apps and sessions. Log out of all sessions, revoke every connected app you don't actively use, and check Connected accounts.

  4. Security → Two-factor authentication: turn on an authentication app or security key. Turn off SMS as a method once another is active.

  5. Review Account information: email, phone and the "Protect your account" settings. Delete any posts or DMs the attacker sent, and post a short note that the account was compromised.

  6. If you reused this password anywhere, change it there too. That is where the attacker got it.

Avoid

  • Replying to "X Support" accounts that DM you. Support doesn't initiate DMs.
  • Paying for verification "restoration."
  • Leaving the connected apps list unreviewed. Most X compromises live there.

After you're back in

Make sure it can't happen the same way twice.

  • Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
  • Close that door specifically, then the ones next to it.
  • Assume the same people will try again. They usually do.
  • Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.