After a Twitter Account Takeover: Regaining Control and Assessing Exposure

Step one: end the other party's sessions first

Changing the password is the step most people take, and on its own it is not enough. Established sessions often survive a password change. If the other party holds a live session token, they keep operating after you change it.

The correct order is to revoke all logged-in devices, then change the password. Revoking kills every existing session, including yours, and the password change stops them signing in again with the old credential. Only with both done is control actually back.

How to inspect the device list is covered in the login device audit. One detail worth watching: do not rely on device names. Location and last-activity time expose anomalies better, because names can be blank or fabricated.

Step two: remove their standing entry points

A password is the most visible entry point but not the only one. Connected third-party apps, linked email addresses and phone numbers, and backup verification methods are each a way in that bypasses the password entirely.

Entry point	Risk	Action
Connected apps	May hold long-lived access	Revoke all, re-authorize as needed
Linked email	Can be used to reset the password	Confirm it is still yours, check forwarding rules
Linked phone number	Can receive verification codes	Confirm the number was not changed
Backup verification	May point at an unfamiliar address	Review each one and replace

The email row gets overlooked. If a forwarding rule was added inside the mailbox, account notifications keep flowing to the other party even after the social account itself is clean. Check the mailbox too.

Step three: work out what was done

This is the slowest step and the one most often skipped. Four categories of action need separating:

• Posts that were published. Possibly used to defraud your followers, and they may leave a policy violation on the account.
• Posts that were deleted. You may consider that cleanup, but the deletions themselves may have been part of a pattern.
• Profile details that were edited. Avatar, bio and link are the usual targets; until reverted, visitors see the other party's version.
• Messages that were sent. These have the longest tail, because recipients already have them and you cannot recall them.

Cross-referencing the timeline matters. The window of activity is usually limited, and anomalies cluster inside it, so check that period first.

An archive makes this considerably easier. It preserves the posting history, so you can diff it against the current state and find what was removed, which is especially useful if a large batch was deleted and no longer appears anywhere in the account. See downloading your X archive.

Step four: assess the change in exposure

The takeover itself created an exposure event, and this is routinely underestimated. During the period, the other party could read everything in the account, including old posts you had forgotten and message history and account associations.

So the question is not "is the account secure now" but "what did they see." Focus on:

• Whether old posts contain phone numbers, emails, addresses or locations that lead directly back to you.
• Whether messages contained sensitive material the other party could have kept or forwarded.
• Whether profile links point at other platforms, creating a linked exposure.

Checking this by hand is inefficient, particularly on a ten-year-old account. The per-item scan is described in finding phone numbers in posts, and the wider list is in the digital footprint audit checklist.

Step five: harden

Ranked by return on effort, four measures are worth doing:

• Turn on two-factor authentication and use an authenticator app rather than SMS. SMS verification can be bypassed through number transfer attacks.
• Give the account a unique password that is not reused anywhere. Reuse is the fastest way to turn one breach into several.
• Check the mailbox forwarding rules and recovery options. There is more than one door.
• Move the linked email to an address that is used rarely and reserved for the account, shrinking the credential-stuffing surface.

Setup steps are in enabling two-factor authentication. None of this takes half an hour, and it decides whether the same thing happens again.

Step six: wrap up and monitor

Two things remain after recovery.

First, notify people. If posts went out under your name, some followers may already have acted on them. Stating it publicly once is easier than answering individually, and it lowers the success rate of any follow-up approach made in your name.

Second, monitor. For a while after an incident, the account tends to attract unusual sign-in alerts, messages and follow requests, which are signals of continued attempts. Leave the notifications on rather than silencing them.

One clarification: a takeover and a leak are different events. An account that was never taken over can still have its data surface elsewhere, and that calls for a different response. See data brokers and content spread.

About digital-footprint-health.shop

Steps three and four are the part digital-footprint-health.shop covers. After an incident, the tool parses your X archive on your own device, lists where phone numbers, emails and addresses appear and in which years, and returns a 0-100 health score, so you can see what was visible during that window. The analysis is read-only and nothing is uploaded. When you want to act, deletion runs per tweet with pause and resume. Start with the free audit, and see the bulk deletion walkthrough for the cleanup flow.