Computer hacked? Here's exactly what to do.
Spot the warning signs, then work through the first response steps below to lock attackers out immediately — followed by a personalised recovery plan for your computer.
Warning signs
8 signs your computer has been hacked
One of these on its own can be a glitch. Two or more together is a strong indicator that something is wrong — and worth investigating today.
Computer is suddenly slow or crashes a lot
Hidden malware, miners, or remote-access tools eat CPU and memory in the background, making everything sluggish or unstable.
Fans run loud even when idle
If your laptop or PC is hot and noisy without you doing anything, something is working hard behind the scenes.
Network activity when you're not using it
Lights blinking or network usage spiking while idle can mean data is being uploaded — photos, files, or keystrokes.
Programs or browser extensions you don't recognise
New apps in your start menu, unknown browser extensions, or toolbars you didn't install are major red flags.
Mouse moves or windows open by themselves
If your cursor moves on its own, programs launch unexpectedly, or files open without you, someone may have remote access.
Pop-ups, redirects, and weird ads
Sudden pop-ups outside the browser, search results that redirect to ad sites, or a changed homepage point to malware or adware.
You can't open Task Manager, antivirus, or settings
Malware often disables security tools to hide itself. Greyed-out settings or blocked antivirus is a strong signal.
You're locked out of accounts or files
Password reset emails you didn't request, files renamed with strange extensions, or a ransom note all indicate a serious compromise.
First response
The 4 steps to take in the next hour
Work through these in order. Each step closes a path the attacker is currently using to hold or extend their access.
Step 01
Disconnect from the internet
Pull the Ethernet cable and turn off Wi-Fi. This stops attackers from exfiltrating data or pushing more malware while you secure the machine.
Step 02
Change critical passwords from another device
Use a clean phone or tablet to reset your email, Microsoft / Apple ID, and banking passwords first — never from the compromised computer.
Step 03
Turn on two-factor authentication
Add an authenticator app (not SMS) to email and financial accounts before the computer goes back online.
Step 04
Build your recovery plan
Use the tool below to generate a step-by-step recovery plan tailored to your computer and situation.
Recovery plan
Pick your computer to start recovery
Tap your computer, pick the issues, and we'll show a tailored step-by-step recovery plan — assuming you no longer have access.
FAQ
Common questions about a hacked computer
Can someone hack my computer just by visiting a website?
Yes — it's called a drive-by download. A malicious or compromised website can exploit an out-of-date browser, plugin, or operating system to install malware silently. The best defences are keeping Windows, macOS, and your browser fully updated, and running a reputable security tool. Never click 'Allow' on browser notifications from sites you don't fully trust.
Will reinstalling Windows or macOS remove a hacker from my computer?
In almost every case, yes. A clean install (with the drive fully wiped, not a 'reset that keeps my files') removes malware, rootkits, and configuration changes. The exceptions are extremely rare firmware-level implants. After the reinstall, restore from a backup taken before the compromise — and change every password.
How do I know if my PC or laptop has spyware?
Look for unexplained slowdowns, fans running constantly, network activity when idle, unknown processes in Task Manager (Windows) or Activity Monitor (Mac), browser extensions you didn't install, and antivirus that suddenly won't run. Run a full scan with Microsoft Defender Offline or Malwarebytes from Safe Mode for the cleanest result.
What's the difference between a hacked computer and a hacked account?
A hacked account (email, Microsoft, Apple ID, social media) means an attacker has your credentials. A hacked computer means malicious software is running on the machine itself. They're often connected — a hacked computer usually leads to compromised accounts via keyloggers, and stolen account credentials can be used to push malware back onto your devices.
Should I call the police if my computer is hacked?
If money has been stolen, your identity has been used fraudulently, your business data has been encrypted by ransomware, or you suspect a targeted attack, yes — file a report. In the US, use IC3.gov; in the UK, Action Fraud; in the EU, your national cybercrime unit. A police report is also required for most insurance and bank fraud claims.
How fast do I need to act?
The first hour matters most. Every minute a compromised computer stays online is more time for an attacker to drain accounts, harvest passwords, encrypt files, and pivot to your other devices. Disconnect from the internet now and use a different device to start the recovery steps.
Computer security topics
Explore guides grouped by the computer security issues that matter most — from malware and ransomware to remote access, browser hijacking, and rootkits.
Go deeper