Cybersecurity · Responding to a hack
An email sent in your name, a password that no longer works, a sign-in alert from another country: your account has probably just been hacked. Don’t panic. What matters now is how fast you act, and in what order.
Every hour gives the hacker time to read your messages, scam your contacts or go after your other accounts. Here are the 5 steps to remember, in order.
Take back control of your account
- Change your password from a device you know is clean. If your computer is infected, the hacker will see the new password.
- Choose a long, unique passphrase that you have never used anywhere else.
- If the hacker has already changed your password, use the service’s official recovery process. Type the website address yourself: never click a link received by email or text message.
Lock every door behind them
- Sign out of all sessions and all devices (the “Sign out everywhere” option in the security settings).
- Check the recovery email and phone number: hackers often replace them with their own so they can come back later.
- In your mailbox, look for forwarding or sorting rules you didn’t create. It’s fraudsters’ favourite trick for reading your messages silently.
- Remove any connected apps you don’t recognize.
- Turn on multifactor authentication (MFA), ideally with an authenticator app or a passkey rather than a text message.
Stop the hack from spreading
- Change the password of every account where you used the same one, starting with your main email: it’s the key that can reset everything else.
- Warn your contacts, through another channel than the hacked account, not to click links or answer money requests that seem to come from you.
- Run a full antivirus scan on your devices.
Protect your money and your identity
- If the account held banking information or saved cards, call your financial institution at the number on the back of your card.
- Monitor your statements and transactions over the following weeks.
- If personal information may have been stolen, consider a fraud alert with Equifax and TransUnion.
Document and report
- Take screenshots: sign-in alerts, messages sent by the hacker, suspicious transactions. Don’t delete anything.
- Report the hack to the service involved (Microsoft, Google, Facebook, etc.).
- In case of fraud or identity theft, contact your local police, then file a report on the Government of Canada’s Report Cybercrime and Fraud website.
What you should never do
- Don’t pay the hacker or get into a conversation with them.
- Beware of “recovery services” that contact you offering to get your account or your money back: it’s often a second scam.
- Don’t wait to see if “it sorts itself out”.
What if it’s a business account?
A hacked Microsoft 365 account puts the whole business at risk: the hacker can write to your clients from your real address, change the banking details on an invoice or set up CEO fraud. In that case:
- Call your IT support right away, even before changing the password yourself. They can revoke all sessions, reset multifactor authentication, check mailbox rules and trace what the hacker accessed.
- Warn your clients and suppliers if fraudulent emails went out from your address.
- Notify your insurer if you have a cyber policy: many require prompt notification.
In short: take back control, lock the doors, stop the spread, protect your money, then report. And to keep it from happening again: a unique password for every account, a password manager and multifactor authentication everywhere.
To go further, read our 12 steps to protect your business in 2026.
Has your account been hacked, or do you have a doubt?
Appelez le tech · 1 833 444-10419 documents ready to adapt: IT policy, disaster recovery plan, incident response, Law 25 register and cyber insurance readiness.