Your account was hacked: the first-day playbook

Finding a strange post on your account, a changed password, or messages you never sent is a sickening moment. The first day is not about fixing everything at once. It is about stopping further access, protecting your fans from fake posts, and keeping good records. Work in order, use official platform routes only, and do not click links in suspicious emails about the hack itself, because those messages are often part of the same attack.

Start with the account you earn from, if you can still get in. Change the password to a new, unique one you use nowhere else, then sign out other sessions and devices in the account settings. Turn on two-factor authentication with an authenticator app if it is not already on. If you are fully locked out, go directly to the platform's official recovery and hacked-account route from its own site or app, never through a link a stranger sends you.

Move in a sensible order after that. Your email account comes next, because password resets for everything else flow through it, so change its password and check its recovery settings and filters. Then work through your other creator platforms, social accounts, and payment-related logins. If you reused a password anywhere, that account needs a new one too. Keep a private list of what you changed and when, so you do not lose track under stress.

Check the details a stranger might have changed quietly. Look at your display name, bio links, payout or tip links where a platform allows them, connected apps, and any forwarding or auto-reply settings in your email. Remove third-party apps you do not recognise or no longer use. Save screenshots of anything altered before you fix it. Those records help platform support understand the incident and help you spot a second change later if one appears.

Warn your fans once, clearly, and then stop repeating it. A short post from a recovered account, or a message on another official profile, can say the account was compromised, that strange posts or payment requests were not from you, and that fans should not send money through new links until you confirm things are secure. Keep the tone calm and factual. Do not share technical details that could help the person who did this try again.

Use platform support properly. Report the compromise through the hacked-account or support route, give the dates, changed details, and screenshots you saved, and keep the case reference somewhere safe. Be patient but persistent, and reply inside the same case where you can instead of opening many duplicate cases. If a platform offers a way to confirm your identity, use only that official process. Never pay a stranger who claims they can recover accounts for a fee.

Watch for impersonation while you recover. A hacked account is often followed by a fake profile using your photos, offering private deals or asking fans to move to a chat app. Report those profiles as impersonation, tell fans your only official links, and ask your protection team to file on them as well. Nullva reports impersonators and, on Pro at $69/mo and above, that work sits alongside daily scanning rather than being a separate errand for you.

Once access is stable, turn to leaks. A compromise sometimes leads to private files, drafts, or unreleased sets being copied, so check what the account held and assume anything stored there may surface. Give your protection team the dates of the incident and the names of any sets at risk. Nullva can start a scan, file on anything already public, delist results, and patrol for re-uploads while you focus on your account and your audience.

Look after the money side without rushing. Review recent payouts and account notices through the official platform, and contact your bank or payment provider through their official channels if something looks wrong. Do not share financial details in fan messages or with anyone who contacts you about the incident. Keep any suspicious emails rather than deleting them, because headers and timing can help support teams. This is general guidance, not financial or legal advice for your situation.

Finish the first day by making the next one easier. Store backup codes safely offline, confirm your recovery email and phone are yours, and write down which accounts now have authenticator protection. Then rest. A hack is exhausting, and tired decisions cause second problems. With access secured and a leak watch running, most creators can return to posting on a normal rhythm while support cases and takedowns continue in the background.