If your account was hacked or you suspect surveillance

For anyone locked out of an account, impersonated, alerted to a login from an unknown device, or warned by Apple or Google about a state-sponsored attack.

The 5-minute minimum

• Act from another, trusted device. If you still have access: change the password, end all other sessions, turn on a second factor. In Telegram: Settings → Devices → Terminate All Other Sessions, then change your cloud password.
• Start with your email: all your other accounts are recovered through it. Check whether someone else's recovery addresses or phone numbers, forwarding rules or filters have been added.
• Warn family and colleagues through another channel: someone may ask for money, codes or documents or set up meetings in your name.
• Write to the Access Now helpline: they help recover the account and understand what happened, free of charge, around the clock, in Russian.

If you are at risk

• Take an Apple spyware warning or a Google 'government-backed attack' warning seriously. Discuss important things from another device, turn on Lockdown Mode on iPhone or Advanced Protection on Android, and contact Access Now. In its section on threats Apple itself refers affected people to this helpline.
• Think about how you could have been hacked: a link in a message, a code from an SMS, a seized phone, a reissued SIM card. This decides what to change first.
• Phishing 'from Telegram': from October 2024 to July 2026, users in Russia, Belarus and Kazakhstan received 'security warnings' in secret chats from unknown accounts, with a threat of blocking and a link to a fake login page (RESIDENT.NGO). Enter your login code and cloud password only in the app itself, not on pages opened from links.
• Russians who have left, journalists and rights defenders are targeted by phishing: emails in the name of Google and email services, fake login pages. Citizen Lab and Access Now link some of these attacks to the FSB. Verify the sender through another channel and protect your email with a passkey or a hardware security key.
• Save evidence: login alerts, screenshots of messages sent in your name, with dates. If something dangerous is published in your name, your lawyer will need them. Net Freedoms Project helps with publications made in your name.
• If the phone may be infected, don't reset it before specialists have checked it: a reset erases the traces. While it is being checked, use another device. Besides Access Now, RESIDENT.NGO helps non-profits and activists from Eastern Europe, and RSF's Digital Security Lab helps journalists (RSF is 'undesirable' in Russia).

What not to do

• Don't sign in to accounts from an infected or seized device.
• Don't pay 'hackers' who promise to recover the account, and don't write to 'support' found in ads and comments.
• Don't delete the account in a panic: the evidence of the hack will go with it. If there is a case, decide with a lawyer.
• If a case has been opened, a report drawn up or your phone seized, don't delete anything without a lawyer: deletion can be used against you and won't remove what the authorities have already copied.

What traces remain

• Assume the attacker saw and could copy everything in the account: messages, contacts, cloud.
• Changing the password does not undo what has already been downloaded.

current as of 26 September 2026. More: Access Now Digital Security Helpline (24/7, Russian spoken); Digital First Aid Kit: I lost access to my account (Russian); Digital First Aid Kit: my device is acting suspiciously (Russian); Apple: threat notifications and protection against mercenary spyware; Google: government-backed attack warnings; RESIDENT.NGO: two years of Telegram login-code phishing against users in Russia, Belarus and Kazakhstan (23.07.2026); Citizen Lab and Access Now: phishing targeting Russia's perceived enemies abroad (14.08.2024); Teplitsa: how activists' Telegram and email accounts get hacked (06.06.2025, updated 05.2026) (foreign agent); First Line: two-factor authentication; Security in-a-Box: if your account was compromised (Russian)