Been Hacked How Do I Fix It?
Been Hacked is a practical guide for people and small businesses in the UK who need calm, plain-English help after a suspected hack. The first priority is to stop further damage, preserve useful evidence and avoid rushed decisions that make recovery harder.
Start by disconnecting affected devices from the internet if you can do so safely, but do not wipe phones, laptops or mailboxes before important evidence has been captured. Change passwords from a separate trusted device, enable multi-factor authentication where possible and check whether email forwarding rules, payment details or administrator accounts have been changed.
For Microsoft 365, Google Workspace, domain names and social accounts, look for unusual sign-ins, new inbox rules, unfamiliar recovery details and messages sent without your knowledge. If money, client data or business systems are involved, keep a written timeline of what happened, who noticed it, what was clicked and which accounts may be affected.
IT Life-Raft can help turn the incident into a clear recovery plan: secure the accounts, review devices, check backups, reduce repeat risk and explain the next steps without jargon. The aim is not to panic; it is to regain control, protect evidence and make the business safer than it was before the incident.
Useful next steps include reviewing Microsoft 365 security settings, checking endpoint protection, confirming backup coverage, tightening administrator access and training staff to spot follow-up scams. A good recovery also includes prevention, because attackers often try again once they know an account or business has been vulnerable.
More detail
If you are in or around the UK and believe you have been hacked, disconnect first, preserve evidence, and get trusted support quickly.
Step 1: Know the signs that may indicate you have been hacked.
What Might a Cyber Breach Look Like?
- Locked accounts or password changes. You suddenly can’t access email, systems or cloud services.
- Strange emails sent from your account. Contacts report suspicious messages, links or attachments.
- Missing, renamed or encrypted files. Files disappear, change name or become unreadable.
- Unexpected pop-ups or warnings. You see unfamiliar security alerts or software prompts.
- Login alerts from unknown locations. You get sign-in notifications from places or devices you do not recognise.
- Unusual financial activity. Invoices are altered, payments are redirected or bank activity looks wrong.
- New software or tools you didn’t install. Remote access tools or unknown apps appear.
- Disabled security features. Antivirus, firewall or backups stop working.
- Staff reporting odd behaviour. Files move, emails disappear or systems behave unusually.
Step 2: Simple Steps To Limit Damage After You Have Been Hacked
- Immediately disconnect devices from the Internet or turn off your internet connection.
- If you are talking to someone claiming to be from a bank or IT support, disconnect and avoid further interaction.
- Speak to a trusted colleague, director, family member or adviser before taking risky action.
- Make notes of events, capturing dates, times, names, phone numbers and affected accounts.
- Do not post about it online.
- List your internet accounts, including email, Microsoft 365, banking, cloud software and subscriptions.
- Locate backups, but do not overwrite or delete evidence.
- Do not pay ransom demands without professional advice.
Step 3: Reach Out To A Trusted IT Support Company Such As IT Life-Raft, Avoid Using Email
You do not know if someone else is watching your email. Time is against you, so use a trusted phone number or known contact route. Some cyber breaches are designed to intimidate or embarrass the victim into delaying help. IT Life-Raft will help you focus on containment, account recovery and practical next steps.
Step 4: Setting Expectations For Anyone That Has Been Hacked
The first focus is containment. In some incidents the damage may already have been done, and it may not be possible to reverse every action of a cyber breach. The priority is to stop further damage, secure devices, reclaim accounts and protect money movement.
Step 5: Securing Your Desktop or Laptop
Devices may need to be isolated, checked, updated and monitored. Do not reconnect affected machines unless instructed. If remote support is required, use only the link or instructions provided by a trusted IT support contact.
Step 6: Securing Accounts
After devices are contained, focus on account recovery. Reset passwords from a clean device, enable multi-factor authentication, review email forwarding rules, check payment details and confirm that no unauthorised users remain in Microsoft 365, Google Workspace, banking or cloud systems.
Step 7: Review & Post Cyber Breach Monitoring
For business incidents, consider whether personal data, customer data or payment data may be involved. Internal policies, insurers, banks, the ICO or law enforcement may need to be contacted depending on the incident.
- Monitor accounts for further suspicious activity.
- Check whether email rules or recovery details were changed.
- Review endpoint protection, backups and patching.
- Check whether details have appeared in known breach datasets using Have I Been Pwned.
- Use a password manager and unique passwords.
Need urgent help?
If you need practical containment guidance after a suspected hack, contact IT Life-Raft for calm, plain-English support before deleting evidence or resetting the wrong account.
