The critical 15 minutes after a cyberattack: A step-by-step account recovery guide

Here is the emergency plan you should implement during a cyberattack, based on Çaylı’s recommendations:

1. Stop the damage (0–2 minutes)

Do not lose a second in taking action. Your first task is to check whether you still have access to the account.

If you have access: Put aside the device where you noticed the problem and continue the process on a different, secure device.

If you do not have access: Without wasting time, open the platform's official "Account Recovery" page.

If there is a financial risk: If the attack affects your bank accounts, call your bank immediately to freeze your cards and all online transactions.

Disconnect: If you suspect your device has a virus, disconnect from the internet. This will instantly stop data leakage. Start a security scan, but move on to the other steps from a different device without waiting for it to finish.

2. Rebuild secure access (3–6 minutes)

Attackers often leave "backdoors" to continue monitoring you even if you recover the account.

Cancel hidden redirects: Check your email settings. Attackers may have created rules that forward a copy of incoming emails to their own addresses. Delete these.

Update information: Check the recovery email address, phone number, and backup codes to ensure they belong to you.

Password and 2FA: Set a new, hard-to-guess password that you have not used before. Be sure to activate two-factor authentication (2FA) and note down the provided "single-use recovery codes" on a physical piece of paper to keep safe.

Log out of sessions: Use the "log out of all active sessions" option to terminate the attacker's open connection.

3. Control and prevention of spread (7–10 minutes)

Attackers do not stop; when they open one door, they force others as well.

Chain control: Change your passwords on all other platforms where you use the same password as the compromised account.

Trace the tracks: Examine recent login activity, sent messages, or minor changes to your profile information. Note down any activity you do not recognize.

4. System cleaning (11–13 minutes)

Check software: Look for any applications or browser extensions on your computer or phone that you did not install yourself.

Update: Update your operating system and applications to the latest version. Cybercriminals often exploit unpatched, old security vulnerabilities.

5. Notification and reporting (14–15 minutes)

Warn your circle: Inform your family and friends that your account has been hacked. The attacker may ask them for money in your name or send them infected links.

Official notification: Report the attack officially to the relevant platform. If there is a financial loss or a serious breach, do not neglect to contact cybercrime units.

Golden rules for protecting against future attacks

Osman Çaylı, CTO of VBT, a software giant growing in the international arena, summarizes the importance of making account security a standard habit with the following points:

Unique passwords: Use a different password for every account. Instead of trying to memorize complex passwords, get a password manager.

2FA is a must: Even if your password is stolen, a second layer of verification (SMS, app code, etc.) will stop the attacker.

Passkeys: On platforms where possible, switch to "passkey" technology, which is passwordless but more secure.

Beware of phishing: Do not click on suspicious incoming links; stay alert against fake emails that appear to be from banks or social media platforms.

Stay up to date: Never postpone software updates; these updates usually act as a shield against the newest types of attacks.

News Source: 12punto