User actions for suspected account compromise

1. Stay calm, take a deep breath.
2. Take notes about the reasons you think your account has been compromised. Every little bit helps! Document the following:
   1. What did you notice?
   2. Why did you think it was a problem?
   3. What were you doing at the time you detected it?
   4. When did it first occur, and how often since?
   5. What systems are you using? (operating system, hostname, )
   6. What account were you using?
   7. What data do you typically access?
   8. Who else have you contacted about this incident, and what did you tell them?
3. Contact the help desk and be as helpful as possible.

Be patient: the response may be disruptive, but you are protecting your team and the organization! Thank you.