Immediate Isolation: Stop the Bleeding
The moment you notice suspicious activity (e.g., sent emails you didn't write, or a "password changed" alert), you must assume the attacker still has live access. Do not simply change the password first—the attacker may have a session token that bypasses the password entirely.Kill All Active Sessions
Go to your email provider's security settings and select "Sign out of all other sessions" or "Revoke all devices." This invalidates any cookies or tokens the attacker might be using. On Gmail, this is under "Manage your Google Account" > "Security" > "Your devices." On Outlook, it's under "Account Security" > "Sign out everywhere."
Change the Password Immediately After
After revoking sessions, change the password to a long, unique passphrase. Do not reuse a password from another site. If you use a password manager, generate a 16+ character random string. If you don't, write it down on paper temporarily—do not email it to yourself.
Check for Forwarding Rules
Attackers often set up a rule that forwards a copy of all incoming mail to their own address. In Gmail, check Settings > Forwarding and POP/IMAP. In Outlook, check Rules > Manage Rules & Alerts. Delete any rule you did not create. Also check filters that might delete or archive incoming security alerts.
Securing the Identity Layer: Recovery Options and MFA
Once you have regained control of the session, you must ensure the attacker cannot regain access through your recovery methods. This is the most commonly missed step in panic-mode containment.Replace Recovery Phone and Email
If the attacker added their phone number as a recovery option, remove it. Set your own primary and backup recovery methods. If you used SMS-based two-factor authentication (2FA) before the compromise, consider switching to an authenticator app or a hardware security key after you contain the threat—SMS is vulnerable to SIM-swapping.
Rotate App-Specific Passwords
Many users have "app passwords" for third-party clients (e.g., Outlook desktop, Thunderbird, or a mobile mail app). Revoke all existing app passwords and generate new ones only after you have re-authenticated your trusted devices.
Review Third-Party App Access
Go to your email provider's "Connected Apps" or "Third-party access" page. Revoke access to any application you do not recognize. An attacker may have granted themselves access via an OAuth app, which would allow them to read mail even after you change the password.
Protecting High-Value Downstream Accounts
Your email is the master key to your digital life. If you use that address for a crypto exchange, a bank, or a hardware wallet like Ledger, the attacker may have already attempted password resets on those platforms. You must prioritize these accounts in your containment sequence.
| Account Type | Containment Action | Priority |
|---|---|---|
| Email provider (primary) | Revoke sessions, change password, check rules | Immediate (0-5 min) |
| Crypto exchange / brokerage | Withdraw funds to cold storage or freeze withdrawals | High (5-15 min) |
| Hardware wallet (e.g., Ledger) | Verify no recovery phrase has been exposed; do not enter seed on any device | High (verify integrity) |
| Bank / payment apps | Place temporary hold or change login credentials | Medium (15-30 min) |
Why Your Ledger Device Is Safe (If You Follow Protocol)
A hardware wallet like Ledger stores your private keys offline. An email compromise alone cannot steal your crypto unless you have previously entered your recovery phrase into a digital device (e.g., a photo, a note app, or a fake phishing site). During containment, do not type your seed phrase anywhere. If you believe it may have been exposed via a phishing email that mimicked Ledger support, the safest action is to transfer your funds to a newly generated wallet with a fresh recovery phrase—do not just "re-enter" the old phrase.
Check for Pending Transactions
Log into your exchange account and review recent activity. Look for withdrawal requests or API keys that were created recently. Revoke any API keys you do not recognize. If you see a pending withdrawal, cancel it immediately.
Post-Containment Audit and Long-Term Hardening
After you have stabilized the immediate threat, you are not done. A thorough audit prevents a second wave of attacks and helps you understand what data was exposed.
Review Sent Mail and Trash
Look at your "Sent" folder for emails the attacker sent. These often contain phishing links sent to your contacts. Notify those contacts that your account was compromised so they do not click anything. Also check the "Trash" for deleted security alerts that the attacker tried to hide.
Update Your Password Hygiene
If you reused your email password anywhere else, change those passwords now. Use a unique password for every site. Consider adopting a passphrase strategy and a password manager to make this feasible. Enable 2FA on your email account using a hardware security key or an authenticator app—not SMS.
Monitor for Future Compromise
Set up login alerts if your provider offers them. Check your account activity weekly for the next month. If you use a service like TwoFactor Vault to store backup codes and TOTP seeds, ensure that this vault itself is protected by a separate, strong master password and a hardware key. Do not store the vault's master password in the same email account you just cleaned.
Finally, if you ever suspect a second compromise, do not hesitate to repeat this entire process. The cost of a few minutes of inconvenience is far lower than the cost of a drained bank account or a stolen identity.