iCloud, Google Drive or Dropbox hacked: what to do

1. Sign out of the account everywhere using the provider's one-click 'sign out of all sessions' option.

   GoogleApple IDDropboxMicrosoft

2. Change the password from a clean device, then turn on two-factor authentication (authenticator app, not SMS).

3. Open the activity / sign-in history and screenshot every unfamiliar entry — providers rotate these logs after a few weeks.

1. Open every shared folder and remove any account you don't recognize — attackers add their own email so they keep seeing new files.

2. Revoke any 'share links' the attacker created that expose your files publicly.

3. Search the drive for files containing 'password', 'SSN', 'SIN', 'tax', 'passport', 'driver's license' — assume those were copied.

4. Check connected third-party apps and revoke anything you don't recognize or haven't used in 90 days.

   Google permissionsDropbox connected apps

1. Restore files the attacker deleted — every major provider keeps deleted files for ~30 days.

2. If files were encrypted by the attacker, do NOT pay — use the provider's version-history rollback (Google File information → Version history; Dropbox / OneDrive equivalents).

3. If banking statements or credit-card numbers were stored in the drive, call those issuers and request new card numbers.

1. Move secret documents (passport scans, tax returns) into an encrypted file or a password manager's secure-notes feature.

2. Turn on Google Advanced Protection or Apple Advanced Data Protection where available; audit shared folders quarterly.

Related situations