Incident Response for Beginners

Stop the bleeding first

If you suspect compromise, act in this order: contain, then recover, then review. Disconnect a misbehaving device from the network. Sign out other sessions from a device you still trust.

Use a practical checklist

• Change passwords for email first, then banking and other high-value accounts
• Enable or re-check MFA and revoke unknown devices
• Scan or reinstall the affected device using trusted vendor tools
• Review bank and email filters for hidden forwarding rules
• Tell your workplace IT or school help desk if work or school systems are involved
• Save screenshots of warnings or strange emails for reference

Know when to escalate

Contact your bank for financial fraud, local authorities for serious identity theft or blackmail, and platform support for locked accounts. Keep receipts and case numbers.

Contain → Secure accounts → Clean or rebuild device
→ Restore from backup → Review what failed → Adjust habits

Learn without blame

Most incidents start with a believable message or a missed update. Note what worked in your response and update passwords, MFA, backups, or family sharing rules afterward.