Active incident

Breathe. Then do these, in this order.

Whether it's a stolen account, an impersonator scamming your audience, a leak, or a threat, the first hour decides most of what happens next. This page is the first hour. Then call us.

  1. Get to a clean device

    If anything on your phone or laptop might be compromised, switch to a device the attacker hasn't touched: a family member's laptop, a fresh phone. Everything below happens from there.

  2. Secure the email first, not the platform

    Your email is the master key. Change its password from the clean device, turn on two-factor with an authenticator app, and sign out of every other session. If the attacker holds your email, anything you fix on Instagram or YouTube gets undone in minutes.

  3. Check the recovery settings

    In the email account and the platform account, look at recovery email, recovery phone, backup codes and trusted devices. Attackers add their own. Remove anything you don't recognize, then screenshot what's there.

  4. Lock your phone number

    Call your carrier. Add an account PIN and turn on port-freeze or number lock. If the attacker is mid-SIM-swap, this stops the next code from reaching them.

  5. Kill sessions and connected apps

    On each platform you still control, sign out all devices and revoke third-party app access. Stolen session cookies die when you do this.

  6. Document everything, touch nothing else

    Screenshots with timestamps: the fake email, the DM, the changed settings, the impersonator profile, the URLs. Don't delete the phishing message. You'll need all of it for the platform appeal and, if it comes to that, law enforcement.

  7. Tell the people who can be targeted next

    Your manager, editor, assistant, close family. The attacker now has your contacts and your voice. Warn them that any message from "you" asking for money, codes or logins is fake until they hear your voice on a call they placed.

  8. Start the official recovery, once

    Use the platform's real recovery flow, from the official domain, and do it carefully. Platform-specific links are on the hacked page. Appeals are limited. Burning three bad ones is how accounts get lost for good.

What not to do

  • Don't pay a "recovery expert" who DMed you. There are hundreds in every hacked creator's comments. They are a second scam.
  • Don't call a support number you found on Google. Platforms don't have one. Every number you'll find is a scam.
  • Don't pay an extortion demand. It doesn't end, it escalates.
  • Don't post about it from an account the attacker may still control.
  • Don't give anyone, including us, your password or a verification code.

What we do when you call

Containment first. Explanations later.

  1. 01

    Triage call

    Fifteen minutes. What's compromised, what you still control, who else is exposed. We tell you honestly whether we can help.

  2. 02

    Containment

    Email, carrier, sessions, recovery chain, in the right order, with you at the keyboard. We never hold your credentials.

  3. 03

    Recovery and communications

    Platform recovery run correctly. Audience and partner messaging so the bleeding stops. Takedowns for impersonators and leaked material.

  4. 04

    Rebuild

    Once the fire is out, a Lockdown so it cannot happen the same way twice. Evidence preserved for counsel or law enforcement if you choose to pursue it.

Incident work is billed by the hour or day and agreed before we start. See pricing.