There's a particular kind of quiet that follows the moment you realize something is wrong: an email you didn't write sitting in your Sent folder, a router light blinking in a pattern you've never seen, a login alert from a city you've never visited. Most people freeze there, unsure whether to unplug something, call someone, or hope it goes away. A personal incident response plan removes that hesitation. It's a short document, maybe a single page, that tells you what to do in the first hour, the first day, and the first week. You don't need a security team to build one. You need an afternoon and the willingness to think about the worst case while you're still calm.
Before Anything Happens: The Setup That Buys You Options
Response plans fail for boring reasons: you can't get into your own email, you don't know your router's admin password, or the only copy of your tax documents is on the machine that just got compromised. Fix those gaps now, while nothing is on fire.
- A password manager. One strong passphrase you memorize, everything else generated and unique. This alone limits how far a single stolen password can travel.
- Two-factor authentication on email and banking, using an authenticator app or a hardware key rather than text messages, which can be intercepted through SIM-swap attacks.
- Recovery codes printed and stored offline, not in a file called "codes.txt" on the desktop.
- A real backup routine. Keep one copy on an external drive you unplug, and one in a cloud account with its own strong password and 2FA.
- A written inventory of your devices, the accounts that matter most, and the support numbers for your bank, internet provider, and email host.
Print that inventory and keep it somewhere physical. If your phone and laptop are both locked or wiped, a sheet of paper still works.
Step One: Recognize the Breach and Stop the Bleeding
Signs are rarely dramatic. Watch for password reset emails you didn't request, friends receiving strange messages from your accounts, a browser that redirects to unfamiliar sites, a laptop fan that runs constantly, or a router admin page showing devices you don't recognize. Any one of those is enough to act.
Contain first. Disconnect the affected device from the network: unplug the Ethernet cable, turn off Wi-Fi, or isolate it on a guest network if you have one. Leave it powered on for now. If you decide to involve a professional or file a police report, a device that hasn't been wiped holds evidence. Shutting down or reformatting immediately destroys information that might tell you what was taken and how they got in.
Containment beats cleanup. Every minute a compromised machine stays online is another minute it can receive instructions.
Step Two: Rebuild Your Accounts From a Device You Trust
Work from a clean device, ideally one that stayed offline during the incident or a freshly reset phone. Email comes first, because it's the master key to everything else: password resets, banking alerts, work files.
- Change your email password and sign out of all active sessions. Most providers have a "sign out of all devices" option.
- Check the settings that attackers hide in. Look for forwarding rules, filters that delete certain messages, a changed recovery email or phone number, and unfamiliar app passwords or connected third-party apps. Remove anything you don't recognize.
- Turn on 2FA and regenerate your recovery codes.
- Move outward: banking and payment accounts, then cloud storage, social media, shopping, and anything holding a saved card.
- Change the password on the compromised device's own accounts — your Windows or macOS login, your browser sync profile, your password manager master password.
- Tell your contacts. A short message — "ignore any links from my account this week" — prevents someone else from becoming the next victim.
Step Three: Clean the Devices Themselves
The laptop or desktop
Run a full scan with a reputable security tool, but don't treat a clean scan as proof. Persistent threats are designed to survive. If the compromise was serious — someone had remote access, or you clicked through a fake support pop-up and gave them control — the reliable fix is backing up your personal files to an external drive, then reinstalling the operating system from official media. Scan the backup drive before you copy anything back, and copy documents and photos only, not programs.
The router
Home routers are the most overlooked target, because a hijacked one can quietly redirect every device in the house. Log into the admin panel and look for firmware updates, unfamiliar port forwarding rules, and changed DNS settings. If anything looks wrong, do a factory reset, update the firmware, set a new admin password you've never used elsewhere, change the Wi-Fi password, and turn off remote administration and WPS. That last part matters: a router breach undoes every password change you make downstream.
Phones and tablets
Check for apps you didn't install, review which apps have access to your messages and location, and remove any configuration profiles or device-management entries you don't recognize. On phones, a factory reset is a reasonable response to a confirmed compromise, provided your photos and contacts are backed up.
Step Four: Recover, Verify, and Tell the Right People
Call your bank and card issuers if any financial account was reachable, and ask them to flag the account. Review statements line by line for a few months, because small test charges often precede larger ones. Depending on where you live, you may be able to place a fraud alert or freeze your credit file; your bank or a consumer protection office can explain what applies to you.
Report the incident to your local police, particularly if money was stolen or your identity was used. A report also creates a paper trail insurers and banks sometimes ask for. Keep a simple timeline: what you noticed, when, what you changed, who you spoke to. It takes ten minutes to start and saves hours later.
Restore files from backups only after the devices are clean, and verify that the backup predates the intrusion. If a ransom demand appears, don't pay it. Payment funds the next attack and rarely guarantees recovery.
The One-Page Plan to Write This Weekend
Open a document and fill in five headings: What I watch for, What I unplug first, Accounts in priority order, Who I call, Where my backups live. Fill it with real names, real phone numbers, and real account details. Print two copies, keep one at home and one somewhere else, and review it twice a year when you change your passwords.
Then do one honest rehearsal. Unplug your laptop from Wi-Fi, imagine the alert just arrived, and see how far you get before you have to guess. The gaps you find in ten minutes of practice are the ones that won't slow you down on the night it actually matters. For anything involving money, identity, or legal exposure, it's worth a conversation with a qualified professional rather than a solo decision made under pressure.
Photo: Yan Krukau / Pexels
