I've Been Hacked!! Here's Exactly What I Did Next

Last Friday was a busy day for me. Not only was I working and keeping up with the many tasks required to run a startup, but I was also taking care of my 8-year-old daughter. Sometimes, when you're trying to get everything done, you forget to stop, pause before responding, and really take a moment to review your emails thoroughly. My focus was simply to respond and move on to the next task. I wasn't thinking about security. I was thinking about getting through my day. At that moment, I failed to protect myself and my daughter.

I received an email from my daughter's friend's mom. It appeared to be an invitation to a party. This wasn't unusual. She had invited us to events before, so in between multitasking to get everything done before an even busier weekend, I quickly opened the invitation, planning to add the event to my calendar.

I wasn't able to open it, so I sent her a text message.

"Hey, I got your invite, but I'm not able to open it."

She responded, "No, that wasn’t me. I got that email from someone at my daughter's summer school. My email was hacked, and I had to change my passwords and bank information."

I apologized for what had happened to her. Ironically, my own Hotmail account had been hacked nearly 15 years ago. I never regained access to it and eventually had to abandon the account. As recently as last year, I even received emails from that old account with nothing more than "hello," a reminder that someone else still controlled it. Despite that experience, it never crossed my mind that I had just exposed my own Gmail account.

Two days later I was on the phone with my friend  during our regular morning check-in when she said, “ Hey, did you send me an invite to something?” “No why,” I responded. “I got an email from you with an invite.” I quickly opened my email and went to the sent box to discover that the malicious invitation had been sent to every person, company, friend, and family member that I had ever contacted from that account. 

My stomach sank as I realized my Gmail account had been hacked. It could have been prevented if I had simply waited until I had the time to pause and think before responding. "Pause and think" is the same advice I give my daughter before responding online or offline, and ironically, in a busy moment, I didn't follow my own advice. I had no time to sit with guilt or embarrassment. I needed to take immediate action to protect myself and my daughter.

I'm sharing this experience because I want to remind everyone that being hacked is not something that only happens to people who are careless or uninformed. It can happen to anyone. I'm a privacy professional trained to recognize suspicious emails, and I still fell victim to a phishing attack. Several people who received the same invitation, including lawyers, engineers, doctors, and other highly educated professionals, opened it as well and had their accounts compromised.

One of the biggest misconceptions about phishing is that people fall for it because they aren't smart enough to recognize it. In my experience, that's usually not the case. We live in a busy world. We skim. We multitask. We trust familiar names. We respond before we pause. That's exactly what happened to me.

Although the experience was deeply unsettling and felt incredibly violating, I acted quickly. Once I had taken every reasonable step I could to secure my accounts and protect my family's information, I was finally able to sleep at night knowing I had put multiple guardrails in place to reduce the chances that my personal information could be misused. Going forward, my focus shifts from securing my accounts to monitoring them. I'll continue watching for suspicious activity and take action if anything unexpected occurs.

For anyone who has experienced something similar, I'm sorry to welcome you to a club that none of us want to join. I hope that by sharing my experience, I can help protect my friends, family, and others from experiencing the same violation.

Below is the exact checklist I followed after discovering my account had been hacked. Whether you've experienced a phishing attack or simply want to be proactive, I encourage you to review these steps and think about how you're protecting yourself and your family's personal information before something happens.

My Post-Hack Recovery Checklist

✅ Changed my Gmail password immediately.

✅ Signed out all active sessions and devices.

✅ Reviewed Gmail forwarding settings to make sure my emails weren't being secretly forwarded.

✅ Checked for malicious email filters that could hide or delete important messages.

✅ Reviewed connected third-party apps to ensure no unauthorized applications still had access to my account.

✅ Verified my account recovery information hadn't been changed.

✅ Reviewed recent Google security activity and active devices.

✅ Confirmed multi-factor authentication (MFA) was enabled on all of my critical accounts.

✅ Changed passwords for my most sensitive accounts.

✅ Warned as many contacts as possible not to open suspicious emails sent from my account.

✅ Placed a fraud alert on my credit file.

✅ Confirmed my credit freeze was active with all three major credit bureaus.

✅ Requested credit freezes and fraud alerts for my daughter's credit reports with all three major credit bureaus. Because she is a minor, this required certified mail and supporting documentation.

✅ Monitored my financial accounts and enabled transaction alerts.

✅ Documented the incident and kept records in case I need them in the future.

We can't eliminate every risk we'll encounter online, but we can slow down enough to make better decisions. Sometimes that simple pause is the difference between protecting ourselves and becoming the next victim.

That's how we begin to get our peace back.

Note: If you received this invitation from my account and I wasn't able to warn you personally, thank you for your patience and understanding. This invitation was sent without my knowledge after my Gmail account was hacked. I hope the recovery checklist above helps you reduce your risk and better protect yourself if you ever experience something similar.