My First Hacked Account Incident: What I Froze On and What I Learned

I led my first response to a hacked account and froze at the start. Here's how I got moving again, plus thirteen lessons for beginners: login alerts, passkeys, BIMI, collecting evidence, the five whys and more.

Chapters

• 0:00 The moment I froze
• 0:37 Who's telling this story
• 1:12 What happened, in short
• 1:43 Three words you'll hear a lot
• 2:08 The honest part: I froze
• 2:37 How I got unstuck
• 3:00 First move: contain it
• 3:34 Then hunt for backdoors
• 4:19 Thirteen lessons in five steps
• 4:49 Part 1: Detect it early
• 5:21 Turn alerts on, then send them to people
• 5:51 Lesson 2: We lacked monitors
• 6:24 Quick check: alerts
• 6:39 Lesson 3: Weird logins on other devices
• 7:08 What counts as weird
• 7:33 Part 2: Investigate the attack
• 8:02 Who else got that email?
• 8:32 Lesson 5: Indicators of compromise
• 8:59 Follow the muddy footprints
• 9:23 Lesson 6: A forensics collection script
• 9:55 Evidence you can trust later
• 10:25 Your first move
• 10:42 Lesson 7: Use AI to analyze logs
• 11:12 Use AI wisely
• 11:50 Lesson 8: Regular updates to the team
• 12:32 Part 3: Fix how people log in
• 12:58 How a code gets stolen
• 13:22 How a passkey works
• 13:57 A key that fits only the real door
• 14:23 Any MFA stops phishing?
• 14:43 Where passkeys live
• 15:12 Remove the weaker backup
• 15:42 Part 4: Email and people
• 16:25 Lesson 11: Prove your emails are yours
• 16:55 BIMI and the blue check mark
• 17:30 What BIMI can't do
• 18:02 Lesson 12: Train your people
• 18:35 Reporting is a win
• 19:06 Part 5: Learn and recover
• 19:40 Five whys: an example chain
• 20:11 What I'd tell my past self
• 20:39 Your short checklist
• 21:13 Recap: from freezing to moving again

More courses and explainers on the Taistek YouTube channel. New videos every week.

Free download: get my SOC 2 checklist, study guides and ISO 27001 templates at taistek.com/free-resources.