After a Computer Compromise: The Nine Steps We Give Every Client

More of the calls we get now start the same way. Someone let a "support technician" onto their screen, opened an attachment, signed in on a page that only looked like their bank, or lost a laptop. Every tool that makes work easier also gives an attacker a new way in. And once personal information has left your machine, the damage does not stop with the intrusion: the same data can be used for impersonation, financial fraud and account takeovers months later.

This is the checklist we send every client in that situation. The order matters: report and lock down first, rebuild second, keep watching afterwards. First, though, why the calls are coming faster.

Why this is happening faster now

Two things changed in the last two years.

Malware is written faster, by people with less skill. In August 2025 Anthropic reported that "AI has lowered the barriers to sophisticated cybercrime": one actor used an AI coding tool to break into at least 17 organizations, including healthcare providers, emergency services and government bodies, and to write extortion demands that sometimes exceeded $500,000; another, with only basic coding skills, built and sold ransomware for $400 to $1,200 a copy (Anthropic, Detecting and countering misuse of AI, August 2025). In November 2025 Google's threat researchers described an experimental piece of malware that asks an AI model to rewrite its own code so that antivirus signatures stop matching; unfinished, but a sign of where this is going (Google Threat Intelligence Group, November 2025). The attacker no longer needs years of training; the tooling supplies it.

Your voice and face can be copied. A short recording of someone's speech is enough to produce a convincing clone. The FBI's December 2024 alert describes criminals cloning a relative's voice to stage an emergency and demand money, impersonating people by voice to get into bank accounts, and holding real-time video calls as fake company executives (FBI IC3, alert I-120324-PSA). The FTC has warned about the same family-emergency calls since 2023 (FTC, family emergency scams). The damage is not only money: a synthetic "you" can say things to your family, your clients or your employer that you never said, and a business can be talked into a wire transfer by a "CEO" on a video call.

The raw material is usually already on the machine. Many people and businesses keep every personal document in one unencrypted folder: scans of Social Security cards, passports and driver's licenses, tax returns, years of photos, voice messages. On a compromised computer that is a complete kit for a digital clone of a person: the documents to pass an identity check, the photos and voice to make the clone convincing, and private material to blackmail with. In our own casework, these incidents have climbed steeply over the past six months.

Three defenses cost nothing. Agree a code word with your family and your team for any urgent request that involves money or access. Never act on a voice or a video alone: hang up and call back on a number you already have. And keep identity documents and tax records in an encrypted container or an encrypted drive, not in Downloads or on the desktop; delete the scans you no longer need.

1. Report the incident at IdentityTheft.gov

IdentityTheft.gov is the Federal Trade Commission's official site for this. You document what happened, see which risks come with each kind of exposed data (a Social Security number is not the same as an email address), and get a written recovery plan. If identity theft has already occurred, the FTC Identity Theft Report you file there is what credit bureaus and many businesses accept when you dispute fraudulent accounts.

2. Secure every financial account

Call your banks, card issuers, investment firms and any other financial institution. Say plainly that your computer was compromised and ask for additional fraud protection on the account. We strongly recommend replacing account numbers and cards that may have been exposed, not just watching them, and setting new security credentials with each institution.

3. Freeze your credit and protect your Social Security number

Place a credit freeze with all three major bureaus: Equifax, Experian and TransUnion. Freezes are free under federal law, and you can lift one temporarily when you apply for credit yourself. Then request an Identity Protection PIN from the IRS at irs.gov: with it, no one can file a tax return under your Social Security number without the PIN.

4. Replace the computers

Our recommendation is to replace a potentially compromised computer rather than rely on an antivirus scan or even a reinstall of the operating system. Modern malware can persist in firmware, including BIOS/UEFI, where conventional tools do not look. In most cases there is no confirmation that this happened, and most of the time it did not, but new hardware is the only answer that needs no assumption.

Disconnect the old machines and keep them exactly as they are: do not wipe them, do not "clean" them. If a forensic examination is needed later, for insurance, for a police report, or simply to learn what was taken, it needs the original state. Set up the new computers from scratch. Bring your files over after scanning them; do not restore old applications or a full system backup.

5. Change every password from a new, trusted device

Start with your primary email accounts: whoever controls your email can reset everything else. Then banking, cloud storage, your password manager and other financial services. Turn on multi-factor authentication everywhere, preferably with security keys or passkeys rather than text-message codes. In each account, also sign out of all other sessions, check the recovery email and phone number, and remove any device or app access you do not recognize.

6. Secure your phone and your home network

Ask your mobile carrier to add protection against unauthorized SIM transfers and number porting; a stolen phone number defeats text-message codes. At home, review the router, the Wi-Fi settings, every connected device and any remote-access software, including anything a "technician" installed. If there is evidence of compromise, replace or securely reconfigure the equipment.

7. Consider a separate, secure mailing address

Statements, tax documents and replacement cards arrive by post. A dedicated mailing address for financial and sensitive correspondence adds a layer of privacy. It is also worth watching your existing address for unauthorized change-of-address requests, or for mail that simply stops arriving.

8. Monitor your identity

Enroll in an identity monitoring service if you can, and review your credit reports, bank transactions, insurance records and other sensitive accounts on a schedule. If your Social Security number, driver's license, passport or other identifying documents were on the machine, additional safeguards are appropriate; the recovery plan from step 1 lists them for each kind of data.

9. Protect your business and professional accounts

If business passwords, documents, client information or administrative credentials were stored on the affected computers, those systems need the same review: cloud accounts, email, remote access, API keys and any other exposed credentials. Revoke compromised access immediately. Depending on what was exposed, you may also have notification or legal obligations. In Colorado, a business has 30 days from determining a breach to notify affected residents; we covered the details in our post on Colorado's breach-notification law.

What worries us most

Rarely the original intrusion. It is what someone can do with your information afterwards: open accounts in your name, pass a bank's identity checks, "recover" your accounts with your own details, or wait a year and try again. The steps above are about closing those doors, not just the one that was opened.

If you want help with the forensic side, preserving the machines, finding out what was taken and documenting it for insurance or law enforcement, get in touch or read about our digital forensics work.