Skip to content
Irregularpedia Logo Irregularpedia

Personal Incident Response Guide

This guide is for people who have already been hit. For hardening before something happens, read the DFP Guide. For understanding how adversaries operate, read the Threats catalog.

If something is happening to you right now, do not start at the top of this page. Find your scenario in the Emergency Triage below and jump straight there.

Emergency triage — pick the closest match

Section titled “Emergency triage — pick the closest match”

How this guide is structured

Section titled “How this guide is structured”

Three layers, increasing in generality:

  1. Threat-specific pages (/cybersecurity/threats/...) — what the attack looks like, how it works, how to spot it.
  2. Scenario IR pages (the links in the triage block above) — exactly what to do if you got hit by that thing.
  3. This page — the general “Identify → Secure → Restore → Report → Learn → Monitor” framework, with the right order of operations baked in.

If your scenario is on the triage list, go to that page — it has the specific protocol. This page is the fallback when nothing else matches.

Identify — which scenario are you in?

Section titled “Identify — which scenario are you in?”

Pick the row that best describes what happened. Each links into the scenario-specific page or the matching section below.

Money or account-takeover

Section titled “Money or account-takeover”

Device compromise

Section titled “Device compromise”

Personal data / images / identity

Section titled “Personal data / images / identity”
  • Intimate photos of me are being shared without consent → Image-based abuse.
  • Someone is impersonating me on social media → Impersonation.
  • Data breach notification from a service I use → Account takeover (rotate passwords + check Have I Been Pwned) + freeze credit.
  • Identity theft — new accounts opened in my name → Identity theft / fraud.

Scams (you were socially engineered)

Section titled “Scams (you were socially engineered)”

Targeted / advanced

Section titled “Targeted / advanced”

Population-specific

Section titled “Population-specific”
  • I’m a servicemember (junior enlisted/NCO/officer) → Servicemember IR.
  • I’m a military spouse/parent during a deployment → Military family IR.
  • I’m a clearance holder and any personal incident may be reportable → Clearance holder IR.
  • I’m over 60 or helping someone over 60 → DOJ Elder Justice Hotline 1-833-372-8311; AARP Fraud Watch 1-877-908-3360.

Secure — the right order matters

Section titled “Secure — the right order matters”

The biggest single mistake in personal IR is doing the steps in the wrong order. The correct order depends on what was taken. Pick the path that matches:

Path A — Credential theft (infostealer, phishing, vault exposed, session cookie stolen)

Section titled “Path A — Credential theft (infostealer, phishing, vault exposed, session cookie stolen)”

If your passwords / sessions / API tokens may be exposed, rotate from a clean device first. Malware removal can wait — the attacker is already inside. Speed of rotation matters more than scrubbing the infected box.

  1. From a clean device (your phone, a relative’s laptop, a freshly-imaged machine), sign in to your password manager and rotate email first — email controls password reset for everything else.
  2. Rotate financial accounts next — bank, brokerage, payment apps, crypto exchanges.
  3. Rotate identity infrastructure — mobile carrier (prevents SIM swap), GitHub, AWS/GCP/Azure, code-signing keys, cloud storage.
  4. Revoke active sessions on every service you just rotated. Changing the password does not kill stolen cookies. See Revoke sessions.
  5. Crypto-specific: if a hot-wallet seed phrase touched the compromised host, that seed is burned. Set up a new wallet on a hardware device and move funds immediately — see Infostealer page.
  6. Then isolate the compromised device (pull network, do not power off — memory artifacts may help forensics).
  7. Then wipe and reinstall the OS from clean media. Do not restore from a backup taken after compromise.

Path B — Remote control of your device (someone is/was in a remote session)

Section titled “Path B — Remote control of your device (someone is/was in a remote session)”
  1. Unplug the network — yank ethernet, disable WiFi at the device or the router.
  2. From a different device — call your bank/card fraud line, then change passwords starting with email.
  3. Uninstall the remote-access tool (AnyDesk, TeamViewer, Quick Assist, ConnectWise/ScreenConnect, RustDesk, Splashtop) — these are legitimate software, not malware. Antivirus will not flag them.
  4. Take screenshots of the remote-access window, any messages, the calling phone number — evidence.
  5. Assume everything you typed was seen, including obscured passwords. Rotate every credential entered during the session.
  6. See Remote-access scam page for full protocol.

Path C — Ransomware (your files have been encrypted)

Section titled “Path C — Ransomware (your files have been encrypted)”

The generic steps below are wrong for ransomware. See the Ransomware page for the correct protocol: photograph the screen, isolate but do not power off, identify the family, check NoMoreRansom.org, preserve the disk before any reinstall.

Path D — Generic device compromise (spyware, suspicious behavior, unknown apps)

Section titled “Path D — Generic device compromise (spyware, suspicious behavior, unknown apps)”

Use this only if Paths A/B/C do not match.

  1. Disconnect the device from the network.
  2. Image the device if you may need evidence (forensic copy of disk via dd or commercial imager).
  3. Run a full malware scan with reputable AV (Defender, Malwarebytes, ESET, Sophos).
  4. Audit installed apps and browser extensions. Remove anything you do not recognize.
  5. Update OS and applications to current patch level.
  6. Change device-local passwords (login password, screen lock).
  7. Then rotate online account passwords from this device (now that it is clean) or, more safely, from a different clean device.
  8. Enable MFA on accounts that don’t have it — see MFA Guide.
  9. Consider professional help if you handle sensitive data.

Revoke sessions on every account

Section titled “Revoke sessions on every account”

Changing your password does not sign out existing sessions. Stolen cookies stay valid until revoked. Go through every important service:

ServiceWhere to revoke
Googlemyaccount.google.com/device-activity
Microsoftaccount.microsoft.com/devices → Sign out everywhere
AppleiCloud.com → Account Settings → Sign out of unknown devices
GitHubgithub.com/settings/sessions
DiscordUser Settings → Devices → Log out all known devices
SlackWorkspace → Profile → Account settings → Sign out other sessions
AWSIAM → Users → Security credentials → revoke sessions
BankingMost US banks have a “sign out all sessions” or “trusted devices” page in security settings
Signal / WhatsApp / TelegramSettings → Linked Devices → remove anything you did not link

Account takeover

Section titled “Account takeover”

If a specific account was taken over:

  1. Use the account-recovery flow (forgot password / recover account).
  2. If recovery fails: contact the provider directly via their official support channel — for Google/Microsoft/Apple, search “[provider] account recovery” from a clean browser, not from any link in an email.
  3. Once back in: change password, enable MFA (prefer app-based or hardware key over SMS), revoke active sessions, audit connected apps / authorized OAuth, audit recovery email and phone (the attacker may have added theirs).
  4. Check sent folder and recent activity to understand the blast radius.
  5. Notify contacts if the account was used to message them (see Communications protocols).
  6. Watch for related-account fallout: same password reused elsewhere, password-reset links sent to this account.

Money loss / account fraud

Section titled “Money loss / account fraud”

Time matters. Reg E gives consumer protections for unauthorized electronic transfers if reported quickly:

  • Within 2 business days: liability capped at $50.
  • Within 60 days of statement: liability capped at $500.
  • After 60 days: potentially unlimited loss.

Order of calls:

  1. Bank or card issuer fraud line — number on the back of your card. 24/7 at all major US banks. Freeze the account, dispute the charge, request new card/account numbers.
  2. The payment platform if the money moved through Zelle / Cash App / Venmo / PayPal — file in-app fraud report. Zelle and many bank P2P services have a “fraud” path distinct from “scam” — fraud (someone took my account) is reversible more often than scam (I willingly sent it). Push for fraud classification when applicable.
  3. Wire transfers — most US banks have a same-day reversal window for some wires. Call immediately.
  4. Crypto — almost never reversible. Notify the exchange in case the destination wallet is on their platform. Report to FBI IC3.
  5. Gift cards — call the card issuer (Apple, Google, Amazon, Steam) and ask for freeze/cancellation of unredeemed balance.
  6. IC3 + FTC + state AG — see Reporting.
  7. Freeze your credit at all three bureaus to prevent followup identity theft — see Freeze credit.

Identity theft

Section titled “Identity theft”

Someone is opening accounts in your name:

  1. Freeze credit at Experian, Equifax, and TransUnion (all free). See Freeze credit.
  2. Place a fraud alert at one bureau — they notify the other two.
  3. Get reports from annualcreditreport.com (free, weekly).
  4. Report to FTC at identitytheft.gov — generates an Identity Theft Affidavit you’ll need for disputes.
  5. File local police report if needed for creditor disputes.
  6. Dispute fraudulent accounts with each creditor directly using the FTC affidavit.

Freeze credit

Section titled “Freeze credit”

Free, easy, reversible. Lock down all three bureaus:

Full guide with all bureaus and brokers: IntelTechniques Credit Freeze Guide.

Impersonation

Section titled “Impersonation”

Someone created a fake account pretending to be you:

  1. Report through the platform — Meta, X, Discord, LinkedIn, TikTok all have impersonation report forms. Provide ID proof.
  2. Tell your contacts — message your real audience via a verified channel: “Account X is not me, do not respond.”
  3. Reverse-image-search your profile photo to find other imposter accounts (often multiple).
  4. Document everything — screenshots with URLs and timestamps.
  5. Report to FBI IC3 if fraud was committed in your name.
  6. Servicemembers: also report to your service’s CID equivalent.

Lost or stolen device

Section titled “Lost or stolen device”
  1. Use the manufacturer’s find-my-device service to locate and (if needed) remotely wipe.
  2. From a clean device, change passwords starting with email and bank.
  3. Revoke device-bound sessions — see Revoke sessions.
  4. Carrier — block SIM and disable the device IMEI (carriers can blacklist).
  5. File a police report with the device serial/IMEI — needed for insurance and for the carrier blacklist.
  6. Notify financial apps — Apple Pay, Google Pay, Venmo, banking apps can be remotely deauthorized.
  7. If the device contained sensitive work data, notify your employer’s IT/security team.

Device compromise (generic)

Section titled “Device compromise (generic)”

See Path D in Secure.

Network compromise (router, home WiFi)

Section titled “Network compromise (router, home WiFi)”
  1. Change router admin password (default credentials are public knowledge).
  2. Change WiFi password — forces all devices to re-authenticate.
  3. Update router firmware.
  4. Disable remote management / WPS / UPnP unless specifically needed.
  5. Audit connected devices — anything you don’t recognize, kick off and investigate.
  6. Replace if the router is end-of-life and no longer getting firmware updates.
  7. See Router Hardening.

Restore — assume what was lost, plan what’s next

Section titled “Restore — assume what was lost, plan what’s next”

Recovery shape depends on whether you lost data (deletion, ransomware) or trust (compromise, exfiltration).

Lost data

Section titled “Lost data”
  • Backups — restore from the most recent clean backup. If you have versioned backups (Time Machine, restic, Borg, Backblaze), pick a version from before the incident.
  • Cloud trash — Google Drive, iCloud, OneDrive keep deleted files for 30+ days.
  • OS-level recovery — Windows File History, macOS Time Machine, Linux snapshots (Btrfs/ZFS).
  • Last resort — forensic recovery (PhotoRec, Recuva) on a disk image.

Lost trust (assume-compromise thinking)

Section titled “Lost trust (assume-compromise thinking)”

If data was read by an adversary rather than deleted, you don’t restore — you reason about what they now know and what they can do with it. Ask:

  • What credentials were on the box? (Rotate them.)
  • What documents were exposed? (Tax returns, ID scans, address book, medical records, source contacts.)
  • What sessions were active? (Revoke them.)
  • What was the attacker’s likely goal? (Money — watch financial accounts. Data — watch for use against you or your contacts. Espionage — see Clearance holder.)
  • Who else’s data was on this device? (Family, sources, coworkers — notify them via a safe channel.)

Reinstall OS

Section titled “Reinstall OS”
  • Reinstall from official media (download fresh from the vendor, verify checksum).
  • Do not restore from a backup taken after the compromise.
  • Re-flash external drives that touched the compromised system.
  • Set up password manager and MFA before logging into anything sensitive on the new install.

Report

Section titled “Report”

The right reporting path depends on the scenario. Use this matrix:

ScenarioFirst call (most urgent)SecondaryLegal / regulatory
Money taken from bank/cardBank fraud line (back of card)FBI IC3 (ic3.gov)FTC (ReportFraud.ftc.gov); state AG
Money sent via Zelle/Cash App/Venmo/PayPalThe platform + your bankIC3FTC; demand Reg E fraud classification
Money wired (Western Union, MoneyGram, bank wire)The wire service immediatelyIC3FTC
Crypto stolenExchange complianceIC3 (FBI Virtual Asset Unit)IRS Form 4684 if loss > 10k
Identity theft (new accounts opened)identitytheft.govCredit bureaus (freeze + fraud alert)Local police if needed for disputes
Ransomware (business)FBI IC3 + cyber-insurance carrierCISA (stopransomware.gov)State breach-notification laws; PCI
Non-consensual intimate imagery (adult)CCRI Helpline 1-844-878-2274StopNCII.org; platform reportsCivil suit (state law); FBI if interstate threat
NCII (was a minor in image)NCMEC CyberTipline 1-800-843-5678takeitdown.ncmec.orgFederal CSAM laws
Sextortion / extortion threatsFBI tipline 1-800-CALL-FBIIC3Federal extortion statute
Phishing / scam (no loss)FTC ReportFraud.ftc.govreportphishing@apwg.org—
Older-adult target (60+)DOJ Elder Justice 1-833-372-8311AARP Fraud Watch 1-877-908-3360State elder-abuse unit
Servicemember victimArmy CID 1-844-276-9243 (or branch CI)IC3; FTCCFPB Servicemembers’ Office
Military-family targeting during deploymentUnit Rear-D + FRG leaderService Casualty Operations + Service CID—
State actor / FIE / clearance angleLocal CI element / Army CI 1-800-CALL-SPYDCSA; DOD IG 1-800-424-9098SAEDA / SEAD-4
Nation-state targeting (journalist / activist)FBI Field OfficeAccess Now Digital Security HelplineService provider trust & safety
Crime on military installationMilitary Police → CID——
NCII or scam crisis support988 (suicide & crisis)CCRI 1-844-878-2274—

When “call the local police” is the right answer (and when it isn’t)

Section titled “When “call the local police” is the right answer (and when it isn’t)”
  • Right answer: on-installation crimes (call Military Police), local property crimes (stolen device), and when you need a police report number for an insurance claim or creditor dispute.
  • Wrong answer alone: nation-state targeting (call FBI), most financial fraud (call IC3 + your bank), NCII (call CCRI), or crimes that crossed state lines (call FBI). Local police can still take the report, but the federal/specialized channels move the case forward.

Communications & notification

Section titled “Communications & notification”

How you tell people about the incident matters as much as whether you tell them.

Out-of-band — do not use the compromised channel

Section titled “Out-of-band — do not use the compromised channel”
  • If your email was compromised, do not warn contacts from that email. Call, text, or use a different account.
  • If your Signal/WhatsApp/Telegram account is compromised (linked-device abuse), do not warn the contact list from the compromised account — the attacker sees it. Use a different platform or a known phone number.
  • If your phone number is in active SIM-swap territory, do not use SMS or voice calls for sensitive verification — use a verified end-to-end channel.

Source / journalist protection

Section titled “Source / journalist protection”

If your work involves people who could be at risk by association (sources, dissidents, abuse survivors):

  • Assume the attacker has read all message history. Plan for that, do not deny it.
  • Notify sources via a different channel than the compromised one — preferably the channel that source originally chose to contact you on.
  • Coordinate any disclosures with the source on timing — sometimes “stay quiet for 48 hours” is right, sometimes “burn the channel and warn everyone now” is right. The source’s risk drives the choice.
  • See also: Access Now Digital Security Helpline, free 24/7 for human-rights defenders, activists, and journalists.

Notify by relationship

Section titled “Notify by relationship”
  • Financial institutions — already covered in Money loss.
  • Family — if you sent any “I’m in trouble, send money” message from a compromised account, family needs to know.
  • Employer / IT-security team — required for any work-related device or account compromise. Check your employment contract.
  • Customers (business) — required by state breach-notification laws if their data was exposed; varies state-by-state.
  • Affected community / forum / Discord — coordinate with the moderation team; don’t accidentally amplify the attacker’s reach.
  • Other targets — if you were hit by a campaign, similar people you know may be next. Warn them through your community’s normal info-sharing channel (Signal group, mailing list, work chat) — not from the compromised channel.

Learn

Section titled “Learn”

After the immediate crisis, before you forget:

  1. Write a short timeline. What happened, when, what you did. Even a few lines. Future-you (and anyone helping) will need this.
  2. Identify the entry point. Most incidents are: phishing click, reused password, MFA bypass, stolen device, supply-chain (malicious package / fake update), or social-engineering call. Knowing which informs prevention.
  3. Patch the gap that let it happen. A password manager, hardware key MFA, or a single device-isolation habit usually covers the most common gaps. See DFP Guide.
  4. Read about the threat. The Threats catalog describes how each common attack actually works. Spotting the second attempt is much easier than the first.

Monitor

Section titled “Monitor”

Compromised once → likely targeted again. Adversaries often retry through a new vector within weeks.

  • Check accounts weekly for the first 90 days post-incident — bank, email, social, cloud storage.
  • Have I Been Pwned — haveibeenpwned.com — sign up for notifications on your email addresses.
  • Credit monitoring — most US adults are entitled to free credit reports weekly at annualcreditreport.com.
  • Linked devices — periodically audit Signal/WhatsApp/Telegram/iCloud/Google linked devices.
  • OAuth-authorized apps — Google/Microsoft/GitHub all show third-party apps that have access; revoke anything stale.
  • News on the threat actor — if it was a known group or campaign, follow vendor advisories (Mandiant, CrowdStrike, CISA alerts).
  • Outbound traffic monitor — Little Snitch (macOS), GlassWire (Windows), OpenSnitch (Linux) flag unexpected network calls. See alternatives.

See also

Section titled “See also”