Discovering that your child's online account or device has been compromised is worrying, but prompt, measured actions can limit harm. This guide gives a clear checklist of priorities: how to isolate a device, regain control of accounts, preserve evidence, and communicate with school or authorities calmly and effectively.

Why act immediately

Quick action reduces further unauthorized access, prevents misuse of personal data, and stops attackers from pivoting to linked accounts (such as parents' email or shared services). The aims are isolation, recovery, evidence preservation, and prevention of recurrence.

Emergency checklist (priorities)

  1. Isolate the device
  • Disconnect the device from the internet: turn off Wi‑Fi and mobile data. If needed, power off the device.
  • For computers, unplug the network cable or disable Wi‑Fi. Avoid logging into other services until the device is safe.
  1. Secure critical accounts
  • From a different trusted device, change passwords for the compromised account and any other accounts using the same password.
  • Enable two‑factor authentication (2FA) where available.
  • If you cannot access the account, start the provider's account recovery process immediately.
  1. Revoke access and connected apps
  • Sign out all active sessions and devices (most services let you see connected sessions).
  • Revoke access for third‑party apps that may have been granted permissions.
  1. Preserve evidence
  • Take screenshots or photos of suspicious messages, warnings, login notifications, or unusual activity.
  • Record dates, times, and any text of suspicious communications. Keep original emails and direct messages.
  • Do not delete records until you have securely copied them.
  1. Assess severity and risk
  • Determine whether the incident involves sensitive services (email, financial accounts, school systems).
  • Look for demands for money, blackmail, or involvement of sexual or illegal material—these require immediate escalation to authorities.
  1. Clean or restore the device
  • For suspected malware, prefer restoring from a known good backup or performing a factory reset after saving essential files safely.
  • Run updated antivirus or anti‑malware scans before returning the device to regular use.
  • Reinstall apps only from official stores.
  1. Notify relevant parties
  • Inform the school, teachers, or school IT if the compromised account is used for schoolwork or may affect others.
  • Consider reporting to law enforcement when there is fraud, extortion, identity theft, or illegal material involving the child.

What to tell the school or authorities

When contacting school staff or authorities, be concise and share information safely. Include:

  • Identification: child's name and class/grade if related to school.
  • Brief incident summary: when you noticed the issue and which accounts/services are affected.
  • Evidence: screenshots, URLs, or copies of threatening messages.
  • Actions already taken: isolated devices, password resets, contact with the service provider.
  • Specific requests: school IT support, notification for other students, or a formal report to authorities.

Tip: Draft a short written message to send via email or the school's communication platform so you don’t forget key points and to keep a record.

How to talk with your child about the incident

  • Stay calm: children pick up on adult anxiety. Reassure them that you are resolving the situation.
  • Listen without blame: ask what happened and how they think it started.
  • Teach and support: use the event to reinforce safe habits—strong, unique passwords and skepticism toward unknown links.
  • If necessary, limit access to some services temporarily until security is restored.

Prevention and follow‑up

  • Review and update privacy settings on your child’s accounts.
  • Use unique passwords and consider a family password manager for parents and older children.
  • Enable 2FA on all accounts that support it.
  • Keep devices and apps updated with security patches.
  • Have regular conversations about phishing, suspicious links, and risky behaviors online.
  • If financial or identity data were exposed, monitor statements and report to the relevant institutions.

When to get professional help

Seek technical help or an incident response professional if:

  • You cannot remove malware or securely restore accounts.
  • The incident includes financial fraud or identity theft.
  • The attacker is conducting illegal activities involving the child (extortion, sharing illegal material).

Conclusion

A fast, structured response greatly reduces the impact of a compromise. Keep this checklist accessible, reinforce good security habits in the family, and maintain open, calm communication with your child and relevant institutions such as the school. Combining technical steps with clear communication is the most effective defense.