This morning, someone accessed my Instagram account, sent scam messages to everyone I follow, and posted scam content on my story and profile. I'm also concerned that other accounts I had logged into on my computer may have been accessed. I've changed my passwords, deactivated my debit card, and performed a factory reset using the most thorough option available. What else should I do, and how can I check whether malware may still be stealing my information?
4 Answers
Treat the computer as potentially compromised until you secure your accounts. Disconnect it from the internet and use a trusted phone or computer to change every password, making each one long and unique. Turn on two-factor authentication wherever possible, preferably with an authenticator app or security key rather than text messages alone. Also check your email accounts for unfamiliar forwarding rules, recovery addresses, devices, and active sessions, since attackers may use those to regain access.
Don’t panic, but assume reused passwords may be the main issue rather than malware alone. A password manager can generate and store unique passwords, and enabling two-factor authentication on every important account will greatly reduce the chance of another takeover. Don’t accept unsolicited remote-help offers or install tools recommended by strangers.
Contact your bank and request a replacement card if the card details were saved in a browser or account that may have been exposed. Review recent transactions and keep monitoring the account. Sign out of unfamiliar sessions on every service, revoke unknown third-party app access, and make sure your recovery email and phone number haven’t been changed.
A factory reset may be enough for many situations, but a clean operating-system installation from official installation media is more thorough than relying only on the built-in reset option. After reinstalling, fully update the system, enable the firewall, and install software only from trustworthy sources. Avoid using the computer for sensitive logins until it has been wiped and rebuilt.
I already performed the reset, but I’ll consider doing a clean installation from a USB drive as an extra precaution.
I had two-factor authentication enabled on some accounts, such as Google, but not on Instagram and several others. I’ll check the email settings and active sessions too.