SDSUG Compromise Response Guide

A clear, step‑by‑step guide for individuals and organizations who believe they may be experiencing a security compromise. This page is designed to reduce panic, provide structure, and help you determine whether you are facing a true compromise or a benign technical issue.

---

Immediate Actions: What To Do First

1. Stay calm — panic leads to mistakes.
2. Stop all sensitive activity on the affected device or account.
3. Disconnect the device from the internet (Wi‑Fi off, unplug Ethernet).
4. Document what you observed: strange messages, unknown logins, odd behavior, missing files.
5. Do NOT delete or reinstall anything yet — evidence matters.

---

Determine Whether This Is a Real Compromise

Use this quick diagnostic chart to understand what you’re dealing with.

Compromise Likelihood Chart

Symptom	Likely Compromise	Likely Technical Issue
Unknown login detected	✔️
Files missing or altered	✔️
Device behaving erratically after clicking a suspicious link	✔️
Random pop‑ups or ads		✔️ (often software or browser issues)
Slow performance		✔️ (hardware, updates, or resource load)
Password no longer works	✔️
Antivirus alert	✔️
One app crashing		✔️

If two or more compromise indicators are present, proceed as if compromised.

---

Step‑By‑Step Response Guide

1. Identify the Scope

• Which device or account is affected?
• Are multiple systems behaving strangely?
• Has any sensitive data been accessed or changed?

2. Secure Your Accounts

• Change passwords from a clean device.
• Enable multi‑factor authentication.
• Review login history for unusual access.

3. Isolate the Affected Device

• Keep it offline.
• Do not attempt repairs yet.

4. Preserve Evidence

• Take screenshots.
• Note timestamps.
• Save logs if available.

5. Run Trusted Security Tools

• Use reputable antivirus or EDR tools.
• Avoid random downloads.

6. Assess Data Exposure

• Personal information
• Financial data
• Business records

7. Notify Relevant Parties

• Your IT department
• Your security team
• Affected clients or partners (if applicable)

8. Remediate

• Remove malware using trusted tools.
• Reinstall OS if necessary.
• Restore from clean backups.

9. Monitor for Recurrence

• Watch for unusual activity.
• Review logs regularly.

---

When You Should Seek Professional Help

Seek expert assistance if:

• Multiple systems show compromise indicators.
• Sensitive or regulated data may be exposed.
• You cannot determine the cause of the issue.
• You suspect targeted activity.

---

False Alarm Examples

Not every strange behavior is a compromise. Common benign causes include:

• Software updates
• Browser extensions
• Failing hardware
• Network congestion
• Misconfigured apps

---

Key Takeaways

• Don’t panic — follow the steps.
• Evidence matters — preserve it.
• Act quickly but carefully.
• When in doubt, escalate.

---

Need Assistance?

If you believe you are experiencing a compromise and need guidance, SDSUG can help you determine next steps and connect you with appropriate resources.

Professional Assistance and Vendor Directory

If you need professional assistance, SDSUG maintains a vendor‑neutral directory of specialists who handle data compromises, digital forensics, cloud account breaches, and incident response. SDSUG does not endorse specific companies; referral fees may apply. Please review the full disclaimer before selecting a vendor.

Visit the Vendor Directory: Incident Response and Data Compromise.

---

---

Last Updated: September 2026