Responding.
WHAT COUNTS AS COMPROMISED
You entered them on a suspicious page A device was infected A service you used was breached You shared them and cannot be sure You see activity you did not perform
WHAT TO DO IMMEDIATELY
Change the password, from a clean device End all active sessions
Check for changes: accounts, rules, permissions
Change anything sharing that password
THE SESSIONS POINT
Changing a password does not always log out existing sessions.
End them explicitly.
WHAT ELSE TO CHECK
Mail forwarding rules Recovery email and phone Two-factor settings Connected applications
WHY THOSE
An attacker with access frequently sets up a way back in.
WHAT TO DO AFTERWARDS
Enable two-factor, if it was not Review everything that account could reach Tell anyone affected
FOR A BUSINESS EMAIL ACCOUNT
Check what was sent, and warn recipients if necessary.
WHAT TO RECORD
What happened and what you changed.
