FIRST STEP Report it immediately through your approved support or security channel. THEN Stop using the affected account until you receive guidance. If you can safely do so, change the password from a trusted device and sign out of other sessions. INCLUDE IN YOUR REPORT Approximate time of suspicious activity, account name, unusual emails or prompts, whether you approved MFA, and any messages or files involved. CHECK RELATED ACCOUNTS If you reused the password anywhere else, change those passwords too. AFTER RECOVERY Review forwarding rules, recovery email addresses, connected apps, and recent activity for anything unfamiliar.