What to Do After You Discover an Account Has Been Compromised

Start with containment. Change the credential from a trusted device, revoke active sessions where the service allows it and remove unauthorised authentication methods or recovery options. Check for unfamiliar rules, forwarding settings and connected applications. If the account belongs to an organisation, contact the security or IT team immediately. The goal is to remove the attacker's access before investigating every detail.