Account Takeover (ATO)

Account takeover occurs when an attacker gains control of an existing account without its owner's permission. Methods can include stolen passwords, convincing phishing pages, compromised sessions and abused password-reset channels. The harm depends on the account: an attacker might send fraudulent invoices, change advertising settings, steal stored information or lock the legitimate owner out.

A practical defense combines phishing-resistant multi-factor authentication where supported, unique credentials, careful recovery settings and limited administrative privileges. Teams should also monitor unexpected sign-ins, newly added administrators and changes to payment or recovery details. No single control prevents every possible method of takeover.

After suspected compromise, use the service's official recovery channel, revoke suspicious sessions and access tokens, reset affected credentials, check connected apps and assess whether customers or partners were contacted. Preserve logs where feasible and follow relevant incident-notification obligations rather than simply changing a password and assuming the damage is over.