Your Account Might Have Been Compromised: Key Evidence to Preserve for Court and Police

Proofread text:

With the development of digital services, social media accounts are increasingly becoming targets of cyberattacks. That is why the Ministry of Internal Affairs of Ukraine has provided clarifications regarding signs of possible account hacking, ways to check profile security, and the course of action in case of unauthorized access.

The practical significance of these recommendations goes far beyond digital hygiene. Timely detection of account compromise can help prevent loss of access to email, banking services, messengers, and other accounts, as well as help preserve electronic evidence in case of further criminal proceedings.

Recall that earlier "Judicial-Legal Newspaper" reported that the Ministry of Digital Transformation published seven practical digital security algorithms and drew attention to risks that many users do not even consider.

How to recognise an attempt to hack an account

The Law of Ukraine "On the Basic Principles of Ensuring Cybersecurity of Ukraine" defines cybersecurity as one of the key elements of protecting the national information space, while the Law of Ukraine "On Personal Data Protection" imposes the obligation to ensure an adequate level of personal information protection.

At the same time, the Criminal Code of Ukraine establishes liability, in particular, for unauthorised interference with the operation of information (automated) systems, computer networks, or telecommunications networks (Article 361 of the Criminal Code of Ukraine), as well as for related fraudulent actions if access to the account is used to seize funds or property of victims.

The Ministry of Internal Affairs points out that the first signs of possible account compromise may be notifications about login from a new device or browser, requests to change the password, email, or phone number, as well as receiving confirmation codes that the user did not request.

Equally important signals are the appearance of messages, comments, or posts that the account owner did not create, changes in profile settings without their involvement, appearance of unknown contacts or subscriptions, as well as acquaintances contacting with messages about strange requests on behalf of the user. Such signs often indicate that third parties have already gained access to the account.

Why it is important to regularly check login history

Regularly checking the login history of an account has particular practical importance. Most modern social networks allow viewing the list of active sessions, devices, and locations of authorisation.

If unknown devices, other cities, or countries appear among them where the user was not actually present, this may indicate unauthorised access. In such cases, the Ministry of Internal Affairs recommends immediately terminating suspicious sessions or completely logging out of the account on all devices, then changing the password.

Experts also advise performing such checks not only after suspicious notifications but regularly, especially if the user has clicked on suspicious links or entered their credentials on unknown websites.

Email — the key to all accounts

Law enforcement recommends paying special attention to the email and phone number linked to the profile. These are most often used to restore access to accounts.

Compromise of the email can create a risk of simultaneous loss of control over multiple services, including social networks, messengers, internet banking, and other digital platforms. Therefore, protecting the mailbox is effectively one of the key elements of user cybersecurity.

A separate sign of account compromise may be sudden loss of access to the profile when the app logs out automatically and the usual password no longer works. In such a situation, there is a high probability that attackers have already changed the authorisation data.

Legal significance of timely detection of hacking

The legal importance of timely response is explained by the specifics of proving cybercrimes. Ukrainian legislation provides criminal liability for unauthorised interference with information systems, but for effective investigation, preserving digital traces of such interference is extremely important.

Information about login times, IP addresses, active sessions, security service notifications, and correspondence can become important electronic evidence during criminal proceedings or court hearings.

Supreme Court practice: what confirms account ownership

Supreme Court practice shows that during disputes related to the use of social networks, proper confirmation of electronic evidence is of key importance.

For example, in the ruling dated March 5, 2025, in case No. 761/16005/22, the Court recognised that the disputed publication was posted by the defendant, as confirmed by reports on webpage captures, personal photos, posts, and live broadcasts on the page.

The Supreme Court confirmed a similar approach in the ruling dated February 26, 2025, in case No. 372/4284/23, noting that account ownership and the fact of information dissemination are established based on a set of electronic evidence that the court evaluates in connection.

What to do if the account has already been compromised

If there is suspicion that the account has fallen into the hands of third parties, the Ministry of Internal Affairs recommends immediately changing the password, terminating all active sessions on other devices, enabling two-factor authentication, and using the official access recovery procedure.

Law enforcement also warns against contacting third parties or services that offer to quickly restore the account for a fee. Such offers are often part of new fraud schemes and can lead to permanent loss of control over the profile.

How to minimise the risk of repeated hacking

To prevent unauthorised access, the Ministry of Internal Affairs recommends using unique passwords for each service, creating passwords at least 12 characters long using uppercase and lowercase letters, numbers, and special characters, not sharing logins, passwords, and confirmation codes with third parties, regularly updating important passwords, and activating two-factor authentication.

It is equally important to follow safe password storage rules: do not write them down in plain text in notes, emails, or messengers, do not save them in browsers on shared devices, use trusted password managers, and regularly install security updates for the operating system and antivirus software.

Thus, the recommendations of the Ministry of Internal Affairs of Ukraine have not only practical but also legal significance, as timely response helps minimise risks and preserve electronic evidence that can be used to protect the rights of the victim.

Subscribe to our Telegram channel t.me/sudua, follow SUD.UA on Google News , and join us on VIBER, WhatsApp, Facebook and on Instagram to stay informed about the important events.