If your account was hacked or you suspect surveillance

For anyone locked out of an account, impersonated, alerted to a login from an unknown device, or warned by Apple or Google about a state-sponsored attack.

The 5-minute minimum

• Act from another, trusted device: change the password, end all other sessions, turn on two-factor authentication.
• Start with your email: it recovers everything else. Check recovery addresses, forwarding rules and filters.
• Warn contacts through another channel that someone may write in your name.
• Contact the Access Now helpline: free, 24/7, Russian spoken.

If you are at risk

• Take Apple threat notifications and Google government-backed attack warnings seriously: switch to another device for sensitive talk, turn on Lockdown Mode or Advanced Protection, contact Access Now (Apple itself refers people to this helpline).
• Keep evidence of the hack (login alerts, screenshots with dates) in case something is published in your name.
• Fake 'Telegram security warnings' sent in secret chats from unknown accounts (October 2024 to July 2026, users in Russia, Belarus and Kazakhstan) led to fake login pages. Enter login codes and your cloud password only inside the app.
• Exiles, journalists and activists are targeted by phishing posing as Google and email providers; Citizen Lab and Access Now link some of it to the FSB. Verify senders through another channel and protect email with a passkey or security key.
• If a phone may be infected, don't reset it before specialists check it.

What not to do

• Don't sign in from an infected or seized device.
• Don't pay 'hackers' who promise to recover the account.
• If a case has been opened, a report drawn up or your phone seized, don't delete anything without a lawyer: deletion can be used against you and won't remove what the authorities have already copied.

What traces remain

• Assume the attacker saw and could copy everything in the account.

current as of 26 September 2026. More: Access Now Digital Security Helpline (24/7, Russian spoken); Digital First Aid Kit: I lost access to my account (Russian); Digital First Aid Kit: my device is acting suspiciously (Russian); Apple: threat notifications and protection against mercenary spyware; Google: government-backed attack warnings; RESIDENT.NGO: two years of Telegram login-code phishing against users in Russia, Belarus and Kazakhstan (23.07.2026); Citizen Lab and Access Now: phishing targeting Russia's perceived enemies abroad (14.08.2024); Teplitsa: how activists' Telegram and email accounts get hacked (06.06.2025, updated 05.2026) (foreign agent); First Line: two-factor authentication; Security in-a-Box: if your account was compromised (Russian)