Breach response plan

1. 1. Change your EMAIL password from a clean device + enable 2FA
2. 2. Sign out all sessions (active devices) on email and the account
3. 3. Check email forwarding rules/filters — remove foreign ones
4. 4. Change passwords for banking, finance, government services
5. 5. Freeze/reissue cards if payment data was involved
6. 6. Rotate passwords anywhere the leaked one was reused
7. 7. Warn contacts — the account may be used for scams
8. 8. Screenshot evidence → report to cyber police + bank
9. 9. Save recovery codes, review password manager
10. 10. Monitor statements and credit history for a week

The first 30 minutes are critical. Email first — everything resets through it. Then finances. Change passwords from a clean device. Keep screenshots — evidence for bank/police. Check email forwarding rules — attackers add hidden copies.