A hacked cloud account can expose files, create malicious shares, and interfere with recovery. This repeat-use checklist helps you contain the incident, recover access, inspect file activity, and track security changes across Google Drive, Dropbox, and OneDrive.
Overview
Cloud account takeover recovery has two separate goals: regain control of the account and determine what may have changed while someone else had access. Changing a password is important, but it is not a complete recovery plan. A person who accessed the account may still have an active session, an authorized app, a shared link, a forwarding rule, or a copy of a sensitive file.
Use this guide as an incident-response tracker. Record what you find, the date and time of each action, and any issue that remains unresolved. If the account belongs to an organization, preserve relevant evidence and involve the administrator or security team before deleting logs or changing settings that may help an investigation.
If files were deleted, moved, encrypted, or overwritten, secure the account first and then begin file recovery. A separate guide to cloud storage retention rules can help you identify possible recycle-bin, trash, and version-history paths.
What to track
1. Access and account control
- Change the password: Use a new, unique password that has not been used on another service. If the cloud account uses an identity provider, secure that primary email or identity account as well.
- Revoke active sessions: Review the provider’s security page for signed-in browsers, phones, computers, and other sessions. Sign out anything unfamiliar, old, or no longer needed.
- Reset multifactor authentication: Confirm that the recovery email, phone number, authenticator methods, passkeys, backup codes, and security keys belong to you or your organization. Remove unknown methods and generate new backup codes where appropriate.
- Check recovery details: Inspect alternate email addresses, phone numbers, security questions, and account recovery contacts. An attacker may add a route back into the account.
Do not rely on an email link to perform these actions after a suspected phishing incident. Open the provider’s known website or official application directly. For a broader review, use the session, app-access, and shared-link revocation checklist.
2. Sharing, permissions, and links
Review files, folders, shared drives, team spaces, and collaboration groups for changes you did not make. Track:
- New people or groups with access to sensitive folders
- Links changed from restricted access to broader access
- Unknown editors, owners, administrators, or external collaborators
- Files moved into unfamiliar folders or shared locations
- Public links that should be disabled or replaced
When you find an unknown share, record the file name, folder, recipient, permission level, and discovery time before removing access if your investigation requires that detail. Then remove the user or group, change the link setting, and review whether the same person appears elsewhere. The cloud storage security checklist for shared files and external links provides a useful follow-up review.
3. Connected apps and devices
Inspect third-party applications, browser extensions, integrations, and device access. Revoke anything unfamiliar or unnecessary, especially tools with permission to read, edit, delete, or share files. Also check whether a desktop sync client or mobile device is still connected. If malware may be present, do not reconnect the device until it has been assessed and cleaned.
4. Mail rules and account activity
If the cloud account is connected to email or a productivity suite, inspect forwarding addresses, filters, inbox rules, delegated access, automatic replies, and sent messages. An attacker may use these settings to hide security alerts or send convincing file-sharing scams from your account. Search for unexpected password-reset messages, file invitations, access notifications, and outbound messages.
5. Files, evidence, and recovery state
Record deleted, renamed, moved, encrypted, or newly created files. Preserve suspicious emails, URLs, headers, screenshots, file names, timestamps, and relevant audit information. Avoid opening questionable attachments or downloading files simply to inspect them. If ransomware or destructive synchronization is suspected, disconnect affected sync clients and avoid making broad changes until you understand which copy is clean.
For platform-specific recovery paths, see the guides for Google Drive, Dropbox, and OneDrive deleted files. Business administrators may also need the Microsoft 365 recovery guide or the Google Workspace administrator guide.
Cadence and checkpoints
Use three checkpoints rather than treating recovery as a single event.
First response: contain the account
Change credentials from a trusted device, revoke sessions, secure MFA, remove unknown recovery methods, and contact the provider through its official recovery channel if access is incomplete. Preserve evidence before deleting suspicious messages or links.
Follow-up review: confirm the cleanup
After the initial reset, revisit sharing permissions, connected apps, devices, forwarding rules, sent mail, recycle bins, version history, and recent activity. Check whether suspicious changes reappear. If they do, assume that an access path remains open rather than repeatedly deleting the same symptom.
Monthly or quarterly maintenance
Even after recovery, review privileged users, external shares, unused integrations, recovery methods, active sessions, and backup status on a monthly or quarterly schedule. The right interval depends on the sensitivity of the files, the number of collaborators, and the organization’s security process. Keep a short log with the review date, reviewer, findings, and outstanding actions.
How to interpret changes
A single unfamiliar login does not always prove that files were accessed, but it warrants verification. Treat changes as higher risk when several indicators appear together: an unknown session plus a new MFA method, unexpected sharing plus outbound messages, or deleted files plus a newly authorized application.
For Google Drive, inspect account security events, Drive sharing, activity, third-party access, and Workspace administrator logs where available. For Dropbox, review account security, linked devices and apps, shared folders, shared links, and file activity. For OneDrive, inspect Microsoft account or Microsoft 365 security information, sharing, connected applications, recycle-bin locations, and audit data available to the administrator. Names and menu locations can change, so use the provider’s current help documentation when a control is difficult to locate.
Separate confirmed facts from assumptions. “A folder was shared externally” is a fact if the activity confirms it. “The attacker downloaded every file” may be only an assumption unless logs or other evidence support it. This distinction helps determine whether to notify affected people, rotate secrets stored in documents, report identity theft after phishing, or seek professional incident-response assistance.
When to revisit
Return to this checklist whenever a provider reports a suspicious sign-in, a password or MFA setting changes unexpectedly, a file-sharing invitation looks unfamiliar, or a collaborator reports messages sent from your account. Revisit it after a device is lost, an employee leaves, a high-value folder changes ownership, or a new integration is added.
Make the tracker part of a monthly or quarterly security review. Start with the last known secure date and compare current sessions, permissions, apps, devices, mail rules, and file activity against that baseline. If anything has changed without a documented reason, pause risky sharing, preserve evidence, and investigate before normal collaboration resumes.
- Mark each item as verified secure, needs review, or not applicable.
- Record the date, account, platform, reviewer, and unresolved finding.
- Repeat the review after every major credential, device, or permission change.
- Use a separate file-recovery plan if content was deleted or altered.
For suspected phishing or a file-sharing scam, verify links independently before signing in or downloading anything. The cloud file-sharing scam verification checklist can help you assess suspicious Google Drive, Dropbox, and OneDrive invitations without extending the exposure.
