User actions for suspected account compromise
- Stay calm, take a deep breath.
- Take notes about the reasons you think your account has been compromised. Every little bit helps! Document the following:
- What did you notice?
- Why did you think it was a problem?
- What were you doing at the time you detected it?
- When did it first occur, and how often since?
- What systems are you using? (operating system, hostname, )
- What account were you using?
- What data do you typically access?
- Who else have you contacted about this incident, and what did you tell them?
- Contact the help desk and be as helpful as possible.
Be patient: the response may be disruptive, but you are protecting your team and the organization! Thank you.