Responding to a suspected compromise

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. You think someone has logged into your game account. What should you do first?

A Tell a trusted adult and change your password straight away

B Wait a week to see if anything else strange happens

2. You clicked a link in a text and then entered your password on the page. Which is the better response?

A Change the password on the real site and turn on MFA

B Delete the text and hope nothing happens

3. You use the same password for your email and your music account. Your music account is hacked. What should you do?

A Change the password on your email and any other account that shares it

B Only change the music account password and leave the rest

4. Which action helps protect an account that may be compromised?

A Share the new password with a friend to keep it safe

B Turn on multi-factor authentication (MFA)

5. You get a phishing email pretending to be your school. What is the best thing to do?

A Forward it to all your friends as a warning

B Report it to a trusted adult or your school's IT team

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Change the password now		AIgnoring the problem leaves any malware on the device. You should scan for malware, report the phishing message and change your passwords.
2Turn on MFA		BTell a parent, carer or teacher now
3If you think an account or device has been hacked, get help from a trusted adult straight away		CAdd a second proof of identity, such as a code on your phone, so a stolen password alone cannot open the account
4If you used the same password on other accounts, change it on every one of them		DWaiting lets the hacker keep access and cause more harm. You should act quickly: tell a trusted adult, change the password, turn on MFA and check for odd activity.
5My account was hacked, but I will wait a week and see what happens		EReset the shared password on all other accounts
6I clicked a scam link, so I will ignore it and never run a malware scan		FReplace the old password with a new, strong, unique one so a hacker who knows the old one is locked out

Definitions

Respond to a compromise

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF suspectedCompromise THEN tell(____________) END IF

FOR EACH account IN sharedList ______________(account) NEXT

changePassword(email) turnOn(___) check(activityLog)

IF deviceActingOdd THEN runScan(_______) END IF

IF isPhishing THEN ______(message) END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF account may be hacked THEN

B keep it secret from everyone

C change the password

D END IF

Question 2

A IF device acts strangely THEN

B tell a trusted adult

C run a malware scan

D ignore any scan results

E END IF

Question 3

A FOR each phishing message

B do not click the link

C reply to the sender

D delete it

Question 4

A IF password was safe THEN

B change the password

C turn on MFA

D END IF

Question 5

A IF hacked pw is reused THEN

B FOR each account using it

C keep its old password

D END FOR

E END IF

Answer Key

Responding to a suspected compromise

Section A: Quick Questions

A — Tell a trusted adult and change your password straight away

A — Change the password on the real site and turn on MFA

A — Change the password on your email and any other account that shares it

B — Turn on multi-factor authentication (MFA)

B — Report it to a trusted adult or your school's IT team

Section B: Match the Pairs

Change the password now → Replace the old password with a new, strong, unique one so a hacker who knows the old one is locked out

Turn on MFA → Add a second proof of identity, such as a code on your phone, so a stolen password alone cannot open the account

If you think an account or device has been hacked, get help from a trusted adult straight away → Tell a parent, carer or teacher now

If you used the same password on other accounts, change it on every one of them → Reset the shared password on all other accounts

My account was hacked, but I will wait a week and see what happens → Waiting lets the hacker keep access and cause more harm. You should act quickly: tell a trusted adult, change the password, turn on MFA and check for odd activity.

I clicked a scam link, so I will ignore it and never run a malware scan → Ignoring the problem leaves any malware on the device. You should scan for malware, report the phishing message and change your passwords.

Section C: Definitions

Respond to a compromise — If an account or device may be hacked, act fast: tell a trusted adult, change the password, turn on MFA and check for odd activity. Also report phishing, change shared passwords and scan for malware.

Section D: Fill in the Blanks

IF suspectedCompromise THEN
    tell(trustedAdult)
END IF

FOR EACH account IN sharedList
    changePassword(account)
NEXT

changePassword(email)
turnOn(MFA)
check(activityLog)

IF deviceActingOdd THEN
    runScan(malware)
END IF

IF isPhishing THEN
    report(message)
END IF

Section E: Spot the Error

B — If an account may be hacked, you should tell a trusted adult quickly. Keeping it secret lets the damage grow. The line should be ' tell a trusted adult'.

D — After scanning for malware you must check the results and deal with any threats. Ignoring them leaves the device at risk. It should be ' check the scan results'.

C — Replying to a phishing message tells the scammer you are there and may give away details. You should report it as phishing instead.

A — The response steps are for when a password may be stolen or compromised. The condition should be 'IF password was stolen THEN', not 'safe'.

C — If a hacked password is used on other accounts, those accounts are at risk too. Each one needs a new password, so the line should be ' change its password'.