Describe what you have observed and contact support through a channel you already trust.

Document what happened

Note the device, account, or service involved, the time, and the messages or behaviour you observed. Preserve relevant evidence without forwarding suspicious attachments.

Use a trusted channel

If you suspect an account is compromised, use a separate trusted device or channel to contact your organisation’s authorised contact or support.

State the impact clearly

Explain whether access is lost, systems are unavailable, or sensitive information may be involved. Follow your organisation’s incident response process.

Do not paste passwords, recovery keys, or sensitive incident evidence into a general chat.