Digital Security Emergency Protocol

A protocol for responding to digital security emergencies — account compromises, identity theft, data breaches, ransomware, or suspected device compromise. Immediate response (first 60 minutes): (1) If a device is compromised: Disconnect it from the internet immediately (turn off WiFi, unplug ethernet). Don't turn it off — forensic evidence may be lost. (2) If an account is compromised: From a DIFFERENT, clean device, change the password of the compromised account and any account that uses the same password. Enable two-factor authentication on everything. (3) If financial accounts are compromised: Call your bank's fraud line immediately (24/7 — the number is on the back of your card). Freeze credit with all three bureaus (Equifax, Experian, TransUnion) — this takes 10 minutes and prevents new accounts from being opened in your name. Short-term response (24-48 hours): (4) Check all financial accounts for unauthorized activity. (5) Review email sent folder for messages you didn't send (compromisers often use your account for phishing). (6) Report to relevant authorities: FTC for identity theft (IdentityTheft.gov), IC3.gov for internet crime. (7) Scan all devices with updated antivirus software. Long-term recovery: (8) Switch to a password manager and generate unique passwords for every account. (9) Review and revoke permissions for third-party apps connected to your accounts. (10) Set up credit monitoring.

When to use it

When you receive a legitimate breach notification. When you notice unauthorized transactions. When you can't access your accounts. When you receive password reset emails you didn't request. When contacts tell you they received suspicious messages from your accounts. When your device behaves unexpectedly (pop-ups, programs you didn't install, extreme slowness).

How it can help

Provides the exact sequence of actions needed during a digital security emergency — when panic and unfamiliarity cause most people to either freeze or take counterproductive steps (like turning off a compromised device, destroying forensic evidence). The credit freeze recommendation is the single most impactful identity theft prevention measure — it's free, takes minutes, and stops the most damaging form of identity theft (new account fraud). The 'different, clean device' instruction prevents the common mistake of changing passwords on a compromised machine.