Choose the incident
Start with the system, provider, or person that is creating the risk.
71 playbooks No sign-up needed
Know what to do when something breaks.
Practical playbooks for the moments that matter: a stolen phone, a hacked account, a production outage.
Quick start
If you have five minutes
Check these five things. If one is missing, open its playbook and fix it when you can.
- Your primary email is protectedIt uses a unique password and two-factor authentication.
- You can recover your accountsBackup codes are saved, and a second signed-in device can approve access.
- Your phone and computer have a recent backupCheck the date of the last automatic backup, not just the setting.
- You can find and lock a missing deviceDevice finding is on, and the screen has a PIN or password.
- Your phone number has a transfer lockYour carrier account has a PIN and port-out protection.
Risk landscape
Where failures tend to land
The library spans six areas, from personal devices and accounts to production systems. Use this map to find where the most recovery paths are waiting to be prepared.
CriticalSeriousDisruptive
Incident library
Playbooks for common failures
71 playbooks
For everyday life
Your devices, accounts, photos, and money. No IT department required.
serious
Amazon account hacked
Orders, a new address, or a payment method showed up on your Amazon account, or Amazon has put the account on hold.
seriousCloud sync deletes files everywhere
A deletion, bad edit, or damaged folder is copied across every device connected to your cloud storage.
disruptiveComputer will not start after an update
A Windows or macOS update leaves the computer stuck, restarting, or unable to reach the desktop.
criticalCryptocurrency wallet drained
Coins left a wallet or an exchange account you control, or someone has your seed phrase or private key.
seriousDiscord account hacked
Your Discord account is messaging friends, spending money, or using an email address you cannot open.
disruptiveHome internet stops working
Your home connection fails when you need it for work, school, payments, or communication.
seriousHome router or Wi-Fi hacked
Someone may control the router that connects every phone, computer, camera, and smart device in your home.
seriousLocked out of your Google or Apple account
Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.
seriousPassport lost or stolen abroad
You are outside the country that issued your passport, and the passport is missing. You cannot board a flight on a cancelled book, and the replacement is not the same document everywhere.
criticalPayPal account hacked
A PayPal payment, a new email, or a linked bank showed up that you did not authorise, or you cannot sign in.
criticalPersonal email account hacked
Someone else is in your email, which means they can reset the password on almost everything else you own.
seriousPhone lost or stolen
Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.
criticalPhone number stolen in a SIM swap
Your phone suddenly loses service because someone moved your number to another SIM or mobile provider.
seriousPhotos and files lost with no backup
The drive died, the phone went in the water, or the folder is simply gone, and there was never a copy.
criticalRansomware on a home computer
A home computer locked your files or the screen and is demanding payment. This is the household version, not a company network.
criticalScammed or fraudulent bank charge
Money left your account that you did not authorise, or you were talked into sending it and have just realised.
seriousSocial media account hacked
Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.
criticalSomeone is using your identity
Accounts, loans, tax filings, or bills are appearing in your name, and you did not open them.
seriousWhatsApp account hacked
Someone else is on your WhatsApp, messaging people as you, or your number was registered on a phone you do not have.
seriousYou received a data breach notice
A company wrote to say your personal information was exposed. Nothing else has gone wrong yet, and you need to cut off the ways it can.
seriousYouTube channel hacked
Your channel is posting videos you did not make, or the Google Account that owns it is no longer yours.
For businesses
Production systems, customer data, vendors, and the people who keep them running.
Access
9 playbookscritical
Business email compromised
An attacker may read mail, reset other accounts, impersonate the business, or redirect payments.
criticalCloud account compromised
An attacker may control cloud identities, infrastructure, data, logs, or the account's billing and recovery settings.
criticalCustomer accounts under credential-stuffing attack
Automated attackers are testing stolen username and password pairs against customer accounts.
criticalGitHub organization compromised
An attacker may control an owner account, repositories, Actions, apps, or credentials connected to your GitHub organization.
seriousLaptop lost or stolen
A work laptop containing sessions, source code, customer data, or recovery credentials is missing.
seriousMFA device lost or broken
The phone or security key used to approve critical logins is unavailable, damaged, or stolen.
criticalPackage registry account compromised
An attacker may be able to publish malicious versions of packages your customers or systems install.
criticalPassword manager locked out
The vault containing business passwords, recovery codes, and secure notes is unavailable or cannot be unlocked.
criticalProduction API key leaked
A credential that can read data, spend money, send messages, or control production has been exposed.
Infrastructure
15 playbooksserious
Background jobs stop processing
Queued emails, imports, billing actions, webhooks, or other asynchronous work is delayed or frozen.
seriousCloud quota exhausted
A provider limit prevents new requests, instances, storage, messages, builds, or other critical resources.
criticalCloud region outage
A cloud region or availability zone hosting critical workloads becomes unavailable or severely degraded.
seriousCritical scheduled job silently stops
A cron task or scheduler no longer runs backups, renewals, reports, cleanup, billing, or synchronization.
seriousDatabase connections exhausted
The application cannot obtain database connections, causing requests, jobs, and administrative access to stall.
criticalDatabase migration fails mid-release
A schema or data migration partially applies, blocks traffic, corrupts records, or leaves old and new code incompatible.
criticalDDoS attack overwhelms the service
Malicious traffic exhausts bandwidth, connections, compute, or expensive application operations.
criticalDNS change takes the business offline
Incorrect nameservers or DNS records make the website, API, email, or verification services unreachable.
criticalDomain expired or lost
Your domain no longer resolves, has left your registrar account, or is registered to someone else.
seriousLaunch produces 20× expected traffic
A launch, mention, campaign, or attack sends far more legitimate traffic than the system was designed to handle.
seriousMonitoring and alerts go blind
Logs, metrics, traces, uptime checks, or alerts stop reporting while production continues to run.
seriousProduction deploy breaks the site
A release causes errors, missing pages, failed checkouts, corrupt writes, or unexpected customer behavior.
disruptiveTLS certificate expired
Browsers or API clients reject your site because its HTTPS certificate is expired, invalid, or issued for the wrong name.
criticalWebsite hacked
An attacker may have altered your site, stolen data, installed persistence, or gained access to connected systems.
seriousWrong feature flag enabled in production
A hidden, unfinished, risky, or destructive code path is activated for the wrong customers or environment.
Data
9 playbookscritical
Backups will not restore
Backups exist, but they are missing, corrupt, incomplete, encrypted, incompatible, or too slow to use.
criticalCustomer receives another customer's data
An export, report, attachment, or support response exposes one customer's information to another.
criticalEncryption key lost or unusable
Encrypted customer data, backups, or infrastructure cannot be decrypted because the required key is missing or inaccessible.
criticalPrivate data appears in a public repository
Customer information, credentials, internal documents, or private source code were pushed to a public repository.
criticalPrivate storage bucket becomes public
Files intended for restricted access can be listed or downloaded without proper authorization.
criticalProduction data deleted
Records, files, tables, or an entire production database were deleted or overwritten.
criticalProduction database corrupted
Production records still exist but values, relationships, indexes, or internal storage are no longer trustworthy.
criticalRansomware or destructive malware
Systems or data are encrypted, stolen, deleted, or held for payment by a malicious actor.
criticalSensitive data appears in logs
Passwords, tokens, payment details, personal data, or private content are being recorded in application or vendor logs.
Money
5 playbookscritical
Customers charged twice
A retry, webhook, race condition, import, or operator action creates duplicate customer charges.
criticalPayment webhooks stop processing
Payment events are delayed, rejected, or ignored, leaving orders, subscriptions, and access out of sync.
criticalStripe payouts frozen
Stripe is still collecting money, but payouts are delayed, paused, failed, or restricted.
criticalSudden wave of chargebacks
Disputes rise sharply because of fraud, customer confusion, service failure, or an organized abuse campaign.
criticalUnexpected cloud bill
Cloud, AI, storage, bandwidth, or API spending rises far beyond the expected amount.
People
4 playbooksserious
Contractor disappears
A contractor becomes unreachable while retaining access, knowledge, devices, code, data, or ownership of critical services.
criticalFormer team member still has access
Someone who no longer works with the business can still reach accounts, code, data, devices, or customer systems.
seriousFounder unavailable for two weeks
The only person with critical authority, access, or knowledge cannot work or communicate.
seriousTeam member leaves without a handover
A key person departs before transferring ownership, context, credentials, work, or recurring responsibilities.
Vendors
8 playbookscritical
App removed from an app store
A mobile app or developer account is rejected, removed, or suspended, blocking new installs, updates, billing, or discovery.
seriousCI/CD provider outage blocks releases
Builds, tests, package publishing, or deployments cannot run through the normal automation provider.
seriousCritical SaaS provider outage
A provider your product or operations depend on is unavailable, degraded, or losing data.
criticalCritical vendor shuts down
A provider announces closure, ends your product, terminates service, or gives a short migration deadline.
seriousNewsletter provider closes the account
Your newsletter account is suspended, disabled, terminated, or inaccessible before an important send.
criticalSoftware dependency compromised
A library, container, plugin, action, SDK, or build dependency may contain malicious or unauthorized code.
seriousTransactional email stops arriving
Login links, receipts, alerts, invitations, and account messages are rejected, delayed, or sent to spam.
seriousVendor API changes without warning
A third-party API changes behavior, authentication, fields, limits, or versions and breaks a critical workflow.
No playbooks match that search.
How it works
A small plan you can use under pressure
Prepare or recover
Use the readiness checklist beforehand or follow urgent actions in order.
Verify control
Finish with observable checks that prove the business is actually recovered.
