SUVAT
Published 1 December 2024 Guidance

What to do if you think your device has been compromised

Step-by-step guidance for individuals on identifying the signs that your computer, phone or tablet may have been compromised by malware or an unauthorised user, and the actions you should take to protect yourself and your data.

1. Signs your device may be compromised

A compromised device may not always display obvious symptoms, but there are a number of warning signs that should prompt further investigation:

1.1 Performance and behaviour changes

  • Unusual slowness. Your device runs significantly slower than normal, even when you are not running demanding applications.
  • Unexpected pop-ups. Frequent pop-up windows appear, particularly those advertising security software, claiming your device is infected, or directing you to unfamiliar websites.
  • Programs opening or closing on their own. Applications launch without your input, your mouse cursor moves independently, or windows appear and disappear.
  • High data usage. Your internet data usage increases significantly without a clear explanation — malware may be communicating with an external server.
  • Fan running constantly. The cooling fan on your laptop or desktop runs at full speed even when the device appears idle, suggesting background processes are consuming resources.

1.2 Account and security indicators

  • Sent messages you did not write. Emails, text messages or social media messages have been sent from your accounts without your knowledge.
  • Password changes you did not make. You are locked out of accounts or receive notifications that your password has been changed.
  • Unfamiliar software or browser extensions. New programs, toolbars or browser extensions appear that you did not install.
  • Security software disabled. Your antivirus or firewall has been turned off and you are unable to re-enable it.
  • Ransom demands. A message appears stating your files have been encrypted and demanding payment — this is ransomware.
Not all of these signs mean you have been compromised. Some may have innocent explanations, such as a software update or a resource-intensive application running in the background. However, if you observe several of these signs together, take action promptly.

2. Immediate steps to take

If you believe your device has been compromised, take the following steps as quickly as possible:

2.1 Disconnect from the internet

Disconnect your device from Wi-Fi and unplug any network cables. This limits the ability of malware to communicate with its controller, prevents further data from being stolen and stops the compromise from spreading to other devices on your network. On a mobile phone, enable aeroplane mode.

2.2 Change your passwords

Using a different, uncompromised device (such as a friend or family member's phone or computer), change the passwords for your most important accounts:

  1. Email accounts — these are the highest priority, as they can be used to reset passwords on other services.
  2. Banking and financial accounts.
  3. Social media accounts.
  4. Cloud storage services (Google Drive, iCloud, OneDrive, Dropbox).
  5. Any other account where you store personal or sensitive information.

Use strong, unique passwords for each account and enable two-factor authentication. See our guidance on setting up two-factor authentication.

2.3 Contact your bank

If you have used your compromised device for online banking or shopping, contact your bank immediately. Inform them that your device may have been compromised and ask them to monitor your accounts for suspicious activity. They may issue new cards or temporarily freeze your accounts as a precaution.

3. Scanning for malware

3.1 Windows computers

  1. Restart your computer in Safe Mode (hold Shift while clicking Restart, then select Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or F4 for Safe Mode with Networking).
  2. Run a full scan using Windows Security (formerly Windows Defender), which is built into Windows 10 and 11. Go to Settings > Privacy & Security > Windows Security > Virus & threat protection > Scan options > Full scan.
  3. Consider running an additional scan with a reputable third-party security tool for a second opinion.
  4. If malware is detected, follow the software's instructions to quarantine or remove it.

3.2 Mac computers

  1. macOS includes built-in malware protection (XProtect and Gatekeeper). Ensure your operating system is fully up to date.
  2. Review your Applications folder and remove any software you do not recognise.
  3. Check System Settings > General > Login Items and remove any unfamiliar startup items.
  4. Consider running a reputable third-party security scan.

3.3 Smartphones and tablets

  • iPhone/iPad: iOS malware is relatively rare. Ensure your device is running the latest version of iOS. Remove any apps you do not recognise. If you believe your device is compromised, back up your data and perform a factory reset.
  • Android: Run a scan using Google Play Protect (open the Google Play Store > tap your profile icon > Play Protect > Scan). Remove any apps from unknown sources. Check Settings > Apps for anything unfamiliar.

4. If the problem persists

If you continue to experience symptoms of compromise after scanning and removing detected threats:

  • Back up your important files (documents, photographs, etc.) to an external drive. Be aware that backing up executable files or applications may preserve malware.
  • Factory reset your device. This returns the device to its original state and removes all software, including any malware. You can then reinstall applications and restore your data from the backup.
  • Seek professional help. If you are not confident performing these steps, take your device to a reputable computer repair service.

5. When to report

  • If you have lost money or your financial details have been compromised, report to Action Fraud at actionfraud.police.uk or call 0300 123 2040.
  • If you have been the victim of ransomware, report to Action Fraud and consider contacting SUVAT for advice.
  • If your identity has been stolen, contact CIFAS to place a protective registration.
  • If you believe your work device or work data has been compromised, notify your employer's IT department immediately.

6. Data breach considerations

If your compromised device contained personal data belonging to other people — for example, if you run a small business or community organisation — you may have obligations under the UK General Data Protection Regulation (UK GDPR):

  • Assess whether personal data has been accessed or exfiltrated.
  • If a personal data breach is likely to result in a risk to individuals, report it to the Information Commissioner's Office (ICO) within 72 hours.
  • Notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms.
  • Document the breach, its effects and the remedial actions taken, regardless of whether you report it to the ICO.
Prevention is better than cure. Keep your devices and software up to date, use strong and unique passwords, enable two-factor authentication and be cautious about what you download and click on. See our full range of guidance for individuals on the SUVAT guidance page.