How does a solopreneur get hacked?

Most solopreneur takeovers start with the email account, because every password reset and account recovery runs through it. Attackers get in through a reused password from an old breach, infostealer malware that steals saved passwords and active session cookies, or a SIM swap that intercepts text message codes. Two of those three defeat multi-factor authentication entirely. Once inside the email, the attacker can reset the password on the payment processor, change the payout bank account, and invoice the customer list.

Why does changing my password not remove a hacker?

Within minutes of breaking into an account, attackers add persistence: mail forwarding rules, filters that delete security alerts, their own recovery email and phone number, their own multi-factor device, and app passwords. All of these survive a password change. You must sign out all sessions, remove the forwarding rules, filters, recovery addresses, app passwords and enrolled devices, and only then rotate the password.

What is the single most important security control for a one-person business?

A hardware security key or passkey on the primary email account. Email is the master key to every other account because it controls password resets and account recovery. A hardware key cannot be phished, cannot be sent to a swapped SIM, and cannot be replayed with a stolen session cookie.

Solopreneur Security Checklist — You're Already a Target

⚠ You are the whole company. There is no IT department coming. These are the controls a one person business needs, in the order that matters.

🔑 The Email That Unlocks Everything

Your email is not a communication tool. It is the master key to every other account you own, because every password reset and every account recovery runs through it. Secure this first or nothing else on this list matters.

Put a hardware security key or passkey on your primary email accountThis is the single highest value control on this page. A physical key or passkey cannot be phished, cannot be sent to a swapped SIM, and cannot be replayed with a stolen session cookie. Everything else here is a repair. This one is a wall. Turn off text message codes as your only second factorSMS codes are defeated by a SIM swap, where someone convinces your mobile carrier to move your number to their phone. Use an authenticator app or a hardware key instead, and keep SMS only as a last resort backup if the service forces it. Turn on your provider's strongest account protection tierGoogle offers the Advanced Protection Program and Microsoft has equivalent hardened settings. They require a security key and deliberately make account recovery harder, which is exactly the point. Print your backup codes and store them offlineNot in your email. Not in a note synced to the account you are protecting. On paper, somewhere physical.

🚪 Find the Back Doors

Changing your password does not evict an attacker. Within minutes of getting in, they add their own ways back, and every one of them survives a password reset. Check these now even if you have never been hacked, and check them first if you have.

Check for mail forwarding rules you did not createA forwarding rule silently copies everything you receive to the attacker. It is the most common persistence trick and almost nobody looks for it. Check for filters that delete or archive security alertsThis is how victims never see the warnings. Google and your payment processor send the alert, a filter deletes it before it is read, and everything looks normal while the business is being emptied. Review every recovery email and recovery phone number on the accountAttackers add their own. If a recovery address you do not recognize is on the account, they can take it back whenever they want. Revoke app passwords and connected third party appsAn app password is a separate credential that keeps working after you change your main password. An OAuth grant is a permanent key, not a login. Revoke anything you do not actively use. Sign out all devices and sessions, then change the password in that orderOrder matters. A stolen session cookie keeps someone logged in even after a password change. Kill the sessions first, then rotate the password, then re-enroll your second factor. Review which multi-factor devices are enrolledAttackers enroll their own authenticator so they keep passing MFA as you. Remove anything that is not yours.

🏢 Separate the Business From You

Most solopreneurs run a company out of a personal Gmail. That single account holds the family photos, the tax documents, the customer list, and the recovery path to the money. Separation does not just lower the risk, it contains the damage.

Use a dedicated business email on your own domainNot the personal account you have had since college, whose password may have leaked in a breach years ago. A business identity with its own recovery path does not fall because of something you did in 2019. Keep a public-facing address and a private account addressThe address on your website and invoices should not be the address your bank, payment processor and domain registrar use to reach you. Separate business and personal banking, and keep business money out of personal accountsThis matters for fraud protection as well as taxes. Business accounts are not covered by Regulation E, which is covered in Chapter 5. Use a separate browser profile or device for business accountsIt limits what a single piece of malware or one malicious browser extension can reach.

💳 Protect the Money

Your payment processor holds more than your income. It holds your customer list, their payment history, and how much each one pays you. An attacker inside it does not have to guess who to target.

Put an authenticator app or hardware key on Stripe, PayPal and every processorStripe supports authenticator apps and hardware keys. It deliberately does not offer email as a second factor, because email is the thing attackers take first. Make sure account recovery does not lead back to a compromised inboxMulti-factor protects the front door. It does very little about the door marked forgot your password. If every recovery path runs through one email, that email is your real password. Turn on alerts for payout bank account changes, and make them push notificationsChanging the payout account is how the money actually gets stolen. An email alert is useless if the attacker controls the email. Use the mobile app notification instead. Verify every payment or banking detail change out of bandCall the number you already had, not the one in the message. This applies to your vendors, your clients, and you. Know how to reach your processor before you need toSave the real support path from inside your logged-in dashboard now. In an incident, searching for a support phone number leads to criminals who bought the ad.

📣 Protect the Channel

If you are a creator, your account is not a profile. It is the business. A hijacked channel is not a privacy incident, it is the company closing overnight, with no regulator and often no human to call.

Hardware keys on every account that earns you moneyYouTube, Instagram, TikTok, your newsletter platform, your course platform, your store. Set up platform recovery before you need itThe people who get their accounts back are the ones who completed recovery and verification in advance. Afterwards there is often no phone number and no human. Add a second admin or backup owner who is not youIf your account is the only way in and your account is gone, the business is gone. Agree on a code word with clients, contractors and familyWhen your face and voice can be cloned, a shared word that was never sent over email is how people confirm it is really you. Monitor for impersonation accounts using your name and likenessSearch your own name and handle monthly. Know each platform's impersonation reporting path before you need it.

👥 Everyone Who Has a Key

The editor, the virtual assistant, the bookkeeper, the contractor who built your site. Each has a login nobody ever revoked, on a device you cannot inspect.

Write down every person who has access to any business accountYou cannot secure what you have not listed. Most solopreneurs are surprised by their own list. Remove access the day someone stops working with youNot eventually. That day. Old contractor logins are a standing invitation. Give each person their own login, never a shared passwordShared credentials cannot be revoked individually and cannot tell you who did what. Require multi-factor authentication from anyone touching money or customer data Put a written device policy in place for contractors before they startWhen a contractor's personal laptop is involved in a breach, you often cannot compel them to hand it over for analysis. Agree the terms before there is an incident.

🤖 Fifteen Tools, Fifteen Doors

AI made it possible for one person to do the work of five. It also gave one person the attack surface of five. Every tool has an API key, an access grant, and a signup nobody ever revisited.

List every AI tool and service with access to your accounts or dataInclude anything you signed in to with Sign in with Google or Sign in with Microsoft. That grant is a standing key to your account, not a one-time login. Revoke access for every tool you no longer useNobody offboards a tool they stopped using. The access stays live for years. Get API keys out of chat threads, email and screenshotsKeys pasted into a conversation live in that conversation forever, including in any account an attacker takes over. Review third-party access quarterlyPut it on the calendar. Fifteen minutes, four times a year. Do not paste customer data into tools you have not vetted

🚨 If It Is Happening Right Now

During a takeover, every channel you normally reach for may already belong to them. Your inbox is theirs. The search result is theirs. The reassuring voice on the phone is theirs. Work in this order.

Move to a channel they do not controlA different device, a different network, and a phone number or account that was never connected to the compromised one. Recover the email account first, before anything elseEvery other account leads back through it. Fixing the payment processor while they still hold the inbox accomplishes nothing. Do the full back door sweep in Section 2 before you trust the account againA password change is not an eviction. Forwarding rules, filters, recovery addresses, app passwords and enrolled devices all survive it. Only use support paths reached from inside a logged-in dashboardNever a support number found by searching. Criminals buy the ads and build the pages that rank for people in a panic. Warn your customers directly, on a channel you controlIf fake invoices went out under your name, your customers need to hear it from you before they pay one. Report it: IC3.gov for cybercrime, and IdentityTheft.gov if personal identity was involved Assume the device may be infected until proven otherwiseIf an infostealer took your session cookies, changing passwords on the same infected machine hands over the new ones too.

This checklist is from You're Already a Target by Corey White.

This is the full list. Most of it will not apply to you. Remi™ finds which of these actually matter for your business, puts them in order, and walks you through them one at a time.

Get Your Personal Cyber Score → Back to Master Checklist →