Hacked? What to Do in the First Hour

By Pieter van Rensburg, Cybertaries

You try to log in and your password doesn't work. Or a client calls to say they just got a strange message from your WhatsApp. Or your bank sends an alert for a payment you never made.

Your stomach drops. That's normal. What you do in the next 60 minutes matters more than anything else, because most of the damage from a hack happens while the attacker still has access.

This is a calm, step-by-step guide for South African freelancers, solopreneurs and small business owners. Bookmark it, or share it with the next person who panics in a Facebook group.

Minute 0 to 10: Stop the bleeding

1. Don't panic-delete anything. Deleting emails, chats or files can destroy evidence you may need later, and it rarely helps.

2. Cut off the attacker's access. Use a device you trust (your phone, if the laptop is the problem) and change the password on the hacked account right now. Pick a long, unique password you have never used anywhere else.

3. Log out everywhere. Gmail, Microsoft 365, Facebook and WhatsApp all have a "sign out of all devices" or "linked devices" option. Use it. This kicks the attacker out even if they already know your old password.

4. Switch on two-step verification. If it wasn't on, turn it on now. It is the single biggest thing that stops someone getting back in.

Minute 10 to 30: Check the damage

Email hacked? Look for rules the attacker may have set up. Check your forwarding settings and inbox filters. A common trick is to quietly forward a copy of everything to the attacker, or to hide replies so you don't notice what they are doing. Delete any rule you didn't create.

WhatsApp hijacked? Re-register WhatsApp on your own phone number. You will receive a verification code by SMS, and entering it logs the attacker out. Then turn on two-step verification inside WhatsApp and warn your contacts that any strange message from you was not you.

Lost mobile signal for no reason (SIM swap)? If your phone suddenly shows no service, and you are also getting account alerts, contact your network provider immediately. A SIM swap lets criminals receive your SMS codes and break into your bank and email.

Banking or payments touched? Call your bank using the number on the back of your card or on their official website. Never use a number from an email or SMS. Ask them to block the card or profile and to investigate any transactions you don't recognise.

Minute 30 to 60: Contain and warn

Change the passwords on your other accounts, starting with the most important ones: your main email, banking, cloud storage, and your accounting software. Attackers love to try the same password on other services.

Warn the people who might be targeted next. Tell your clients, suppliers and staff that your account was compromised and that they should ignore any unusual requests, especially anything involving money, banking details or links.

Scan your devices. Run a full scan with a reputable security tool on your laptop and phone. If you clicked a link or installed something just before the problem started, take that seriously.

Write it down. Note what happened, when you noticed, and what you did. This helps you, your bank, and anyone who assists you afterwards.

Don't forget POPIA

If the hacked account held personal information about your clients or customers, you may have obligations under POPIA, South Africa's data protection law. In some cases you must notify the Information Regulator and the affected people. It is much easier to deal with this properly if you act quickly and keep good notes. If you're unsure whether it applies to you, get advice early rather than hoping it goes away.

After the first hour

The first hour is about containment. The next few days are about making sure it doesn't happen again:

• Use a password manager so every account has a unique password
• Turn on two-step verification everywhere it is offered
• Keep your devices and software updated
• Back up your important files, ideally in two places
• Learn the common scams that target small businesses, such as fake invoices and fake courier or SARS messages

Consider also registering for Protective Registration with the Southern African Fraud Prevention Service (SAFPS) if your personal details were exposed. It adds an extra check when someone tries to use your identity to apply for credit.

Need a hand?

You don't have to do this alone. At Cybertaries, we help South African freelancers and small businesses recover from incidents and then set things up properly so they don't happen again. Our support is remote, with fixed prices and no quote-hunting.

If something has just happened, or you simply want to check that your setup is safe, have a look at what we offer at www.cybertaries.co.za. Our once-off Quick Fix is there for exactly these moments.

Have you or someone you know been caught out by a hacked account? Share this with them. It could save them a very bad day.