Cleaning Up After a Breach: Devices, Passwords and Linked Apps

Why regaining access is not the end

Getting back into a hacked account feels like the finish line, but it is closer to the halfway point. An attacker may have left behind ways to return: a changed recovery address, a hidden forwarding rule, a connected app, or malicious software on a device. Cleanup is about finding and removing those leftovers. It is usually unglamorous work, and it pays off by making a second incident less likely, though nothing can guarantee that.

Start with the device you used

If you signed in to the account from a computer or phone before the incident, that device is a candidate for how the attacker got your password. Not every takeover involves malware; many come from tricked sign-ins or reused passwords. Still, it is sensible to check.

• Install any pending system and app updates. The reasons are explained in the discussion of why phone software updates matter, and the same logic applies to computers.
• Run a scan with the security tool that comes with your operating system, or a reputable one you already trust. Whether to add extra tools is covered in the discussion of antivirus software.
• Remove apps and programs you do not recognize or no longer use.
• Review browser extensions. Some request broad access to the pages you visit, and browser extension risks are worth taking seriously if you installed one shortly before the incident.

If the device still behaves strangely afterward, such as unexpected pop-ups, a slow system, or settings changing on their own, consider backing up your files and resetting it to factory state. A device that you cannot trust should not be used for banking or sensitive sign-ins. If you are not comfortable doing this alone, a qualified technician or the manufacturer’s support service can help.

Rework your passwords, in priority order

Change the password on the compromised account first, if you have not already. Then think about where else the same or a similar password was used. Attackers frequently test stolen passwords on other services, so the real damage from one breach often spreads through password reuse.

A sensible order is:

1. Email accounts, since they can reset everything else.
2. Banking, payment and shopping accounts.
3. Cloud storage and anything holding documents or photos.
4. Social media and messaging accounts.
5. Everything else.

Use a different, long password for each. A password manager makes that realistic because you remember only one strong master password. If you are building a habit around this, the idea of password security in general is worth revisiting.

Also check whether the stolen password came from an older leak. Breach exposure checks can show whether your email address appears in known public breaches, which helps you decide which passwords to retire first.

Inspect email settings carefully

If the compromised account was email, spend a few minutes in its settings. Look for:

• Forwarding addresses that send copies of your mail to someone else.
• Filters or rules that automatically archive, delete or mark messages as read. Attackers sometimes use these to hide reset notices or replies from your contacts.
• Signature or auto-reply text you did not write.
• Recovery email and phone number that you do not own.
• Signed-in devices and recent activity you do not recognize.

Remove anything unfamiliar. These settings are easy to overlook because nothing looks broken.

Remove linked apps and old sessions

Most major services let other apps and websites sign in on your behalf or read parts of your data. Over time, it is easy to collect many of these. After a breach, go through the list and revoke anything you do not clearly recognize or no longer use. Connected app access can keep working even after you change a password, which is why it deserves its own check.

Do the same for signed-in devices. End every session you cannot identify. Some services have a single option to sign out everywhere, which is the simplest choice.

Strengthen the sign-in itself

If you have not done so, turn on two-step sign-in for the accounts that matter most, starting with email. Where possible, pick an authenticator app or a security key rather than text messages. If your phone number was a target, read about SIM swap fraud so you understand why a carrier account PIN or similar protection is worth adding. Treat the carrier account as one more thing to secure.

Replace weak security questions where the service allows it, or fill them with random answers that you store in your manager. Real answers can often be found by an attacker.

Watch for follow-up activity

After a breach, expect some scammers to try again, sometimes pretending to be help. Watch for unexpected password reset emails, sign-in alerts and unusual messages. Turning on transaction alerts for your bank and card accounts gives you early notice of problems, and regular statement review habits help catch small charges.

Keep an eye out for a few weeks. If the same account is compromised again after you have done the steps above, treat it as a sign that something remains, such as a device that has not been cleaned, and consider professional help.

Make a short maintenance routine

You do not need to repeat this full process often. A light routine every few months is usually enough:

• Review signed-in devices and connected apps on your key accounts.
• Delete accounts and apps you no longer use.
• Confirm your recovery email and phone number are still yours.
• Check that your backups still work.

The goal is steady habits rather than perfection. Cleanup after a breach is one of the best moments to improve them, because the reasons are fresh and clear.