Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.
Know what to do when something breaks.
Practical playbooks for the moments that matter: a stolen phone, a hacked account, a production outage.
Quick start
If you have five minutes
Check these five things. If one is missing, open its playbook and fix it when you can.
- Your primary email is protectedIt uses a unique password and two-factor authentication.
- You can recover your accountsBackup codes are saved, and a second signed-in device can approve access.
- Your phone and computer have a recent backupCheck the date of the last automatic backup, not just the setting.
- You can find and lock a missing deviceDevice finding is on, and the screen has a PIN or password.
- Your phone number has a transfer lockYour carrier account has a PIN and port-out protection.
Risk landscape
Where failures tend to land
The library spans six areas, from personal devices and accounts to production systems. Use this map to find where the most recovery paths are waiting to be prepared.
CriticalSeriousDisruptive
Incident library
Playbooks for common failures
61 playbooks
Search playbooks
For everyday life
Your devices, accounts, photos, and money. No IT department required.
Cloud sync deletes files everywhere
A deletion, bad edit, or damaged folder is copied across every device connected to your cloud storage.
Computer will not start after an update
A Windows or macOS update leaves the computer stuck, restarting, or unable to reach the desktop.
Home internet stops working
Your home connection fails when you need it for work, school, payments, or communication.
Home router or Wi-Fi hacked
Someone may control the router that connects every phone, computer, camera, and smart device in your home.
Locked out of your Google or Apple account
Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.
Personal email account hacked
Someone else is in your email, which means they can reset the password on almost everything else you own.
Phone lost or stolen
Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.
Phone number stolen in a SIM swap
Your phone suddenly loses service because someone moved your number to another SIM or mobile provider.
Photos and files lost with no backup
The drive died, the phone went in the water, or the folder is simply gone, and there was never a copy.
Scammed or fraudulent bank charge
Money left your account that you did not authorise, or you were talked into sending it and have just realised.
Social media account hacked
Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.
For businesses
Production systems, customer data, vendors, and the people who keep them running.
Access
9 playbooks
Business email compromised
An attacker may read mail, reset other accounts, impersonate the business, or redirect payments.
Cloud account compromised
An attacker may control cloud identities, infrastructure, data, logs, or the account's billing and recovery settings.
Customer accounts under credential-stuffing attack
Automated attackers are testing stolen username and password pairs against customer accounts.
GitHub organization compromised
An attacker may control an owner account, repositories, Actions, apps, or credentials connected to your GitHub organization.
Laptop lost or stolen
A work laptop containing sessions, source code, customer data, or recovery credentials is missing.
MFA device lost or broken
The phone or security key used to approve critical logins is unavailable, damaged, or stolen.
Package registry account compromised
An attacker may be able to publish malicious versions of packages your customers or systems install.
Password manager locked out
The vault containing business passwords, recovery codes, and secure notes is unavailable or cannot be unlocked.
Production API key leaked
A credential that can read data, spend money, send messages, or control production has been exposed.
Infrastructure
15 playbooks
Background jobs stop processing
Queued emails, imports, billing actions, webhooks, or other asynchronous work is delayed or frozen.
Cloud quota exhausted
A provider limit prevents new requests, instances, storage, messages, builds, or other critical resources.
Cloud region outage
A cloud region or availability zone hosting critical workloads becomes unavailable or severely degraded.
Critical scheduled job silently stops
A cron task or scheduler no longer runs backups, renewals, reports, cleanup, billing, or synchronization.
Database connections exhausted
The application cannot obtain database connections, causing requests, jobs, and administrative access to stall.
Database migration fails mid-release
A schema or data migration partially applies, blocks traffic, corrupts records, or leaves old and new code incompatible.
DDoS attack overwhelms the service
Malicious traffic exhausts bandwidth, connections, compute, or expensive application operations.
DNS change takes the business offline
Incorrect nameservers or DNS records make the website, API, email, or verification services unreachable.
Domain expired or lost
Your domain no longer resolves, has left your registrar account, or is registered to someone else.
Launch produces 20× expected traffic
A launch, mention, campaign, or attack sends far more legitimate traffic than the system was designed to handle.
Monitoring and alerts go blind
Logs, metrics, traces, uptime checks, or alerts stop reporting while production continues to run.
Production deploy breaks the site
A release causes errors, missing pages, failed checkouts, corrupt writes, or unexpected customer behavior.
TLS certificate expired
Browsers or API clients reject your site because its HTTPS certificate is expired, invalid, or issued for the wrong name.
Website hacked
An attacker may have altered your site, stolen data, installed persistence, or gained access to connected systems.
Wrong feature flag enabled in production
A hidden, unfinished, risky, or destructive code path is activated for the wrong customers or environment.
Data
9 playbooks
Backups will not restore
Backups exist, but they are missing, corrupt, incomplete, encrypted, incompatible, or too slow to use.
Customer receives another customer's data
An export, report, attachment, or support response exposes one customer's information to another.
Encryption key lost or unusable
Encrypted customer data, backups, or infrastructure cannot be decrypted because the required key is missing or inaccessible.
Private data appears in a public repository
Customer information, credentials, internal documents, or private source code were pushed to a public repository.
Private storage bucket becomes public
Files intended for restricted access can be listed or downloaded without proper authorization.
Production data deleted
Records, files, tables, or an entire production database were deleted or overwritten.
Production database corrupted
Production records still exist but values, relationships, indexes, or internal storage are no longer trustworthy.
Ransomware or destructive malware
Systems or data are encrypted, stolen, deleted, or held for payment by a malicious actor.
Sensitive data appears in logs
Passwords, tokens, payment details, personal data, or private content are being recorded in application or vendor logs.
Money
5 playbooks
Customers charged twice
A retry, webhook, race condition, import, or operator action creates duplicate customer charges.
Payment webhooks stop processing
Payment events are delayed, rejected, or ignored, leaving orders, subscriptions, and access out of sync.
Stripe payouts frozen
Stripe is still collecting money, but payouts are delayed, paused, failed, or restricted.
Sudden wave of chargebacks
Disputes rise sharply because of fraud, customer confusion, service failure, or an organized abuse campaign.
Unexpected cloud bill
Cloud, AI, storage, bandwidth, or API spending rises far beyond the expected amount.
People
4 playbooks
Contractor disappears
A contractor becomes unreachable while retaining access, knowledge, devices, code, data, or ownership of critical services.
Former team member still has access
Someone who no longer works with the business can still reach accounts, code, data, devices, or customer systems.
Founder unavailable for two weeks
The only person with critical authority, access, or knowledge cannot work or communicate.
Team member leaves without a handover
A key person departs before transferring ownership, context, credentials, work, or recurring responsibilities.
Vendors
8 playbooks
App removed from an app store
A mobile app or developer account is rejected, removed, or suspended, blocking new installs, updates, billing, or discovery.
CI/CD provider outage blocks releases
Builds, tests, package publishing, or deployments cannot run through the normal automation provider.
Critical SaaS provider outage
A provider your product or operations depend on is unavailable, degraded, or losing data.
Critical vendor shuts down
A provider announces closure, ends your product, terminates service, or gives a short migration deadline.
Newsletter provider closes the account
Your newsletter account is suspended, disabled, terminated, or inaccessible before an important send.
Software dependency compromised
A library, container, plugin, action, SDK, or build dependency may contain malicious or unauthorized code.
Transactional email stops arriving
Login links, receipts, alerts, invitations, and account messages are rejected, delayed, or sent to spam.
Vendor API changes without warning
A third-party API changes behavior, authentication, fields, limits, or versions and breaks a critical workflow.
No playbooks match that search.
How it works
A small plan you can use under pressure
Choose the incident
Start with the system, provider, or person that is creating the risk.
Prepare or recover
Use the readiness checklist beforehand or follow urgent actions in order.
Verify control
Finish with observable checks that prove the business is actually recovered.