Know what to do when something breaks.

Practical playbooks for the moments that matter: a stolen phone, a hacked account, a production outage.

Right nowSomething is brokenFind your situation and go straight to the first fifteen minutes.Twenty minutesStop it happeningWork through the safeguards that turn a disaster into an inconvenience.

Quick start

If you have five minutes

Check these five things. If one is missing, open its playbook and fix it when you can.

Your primary email is protectedIt uses a unique password and two-factor authentication.
You can recover your accountsBackup codes are saved, and a second signed-in device can approve access.
Your phone and computer have a recent backupCheck the date of the last automatic backup, not just the setting.
You can find and lock a missing deviceDevice finding is on, and the screen has a PIN or password.
Your phone number has a transfer lockYour carrier account has a PIN and port-out protection.

Risk landscape

Where failures tend to land

The library spans six areas, from personal devices and accounts to production systems. Use this map to find where the most recovery paths are waiting to be prepared.

CriticalSeriousDisruptive

Incident library

Playbooks for common failures

61 playbooks

For everyday life

Your devices, accounts, photos, and money. No IT department required.

Cloud sync deletes files everywhere

A deletion, bad edit, or damaged folder is copied across every device connected to your cloud storage.

Computer will not start after an update

A Windows or macOS update leaves the computer stuck, restarting, or unable to reach the desktop.

Home internet stops working

Your home connection fails when you need it for work, school, payments, or communication.

Home router or Wi-Fi hacked

Someone may control the router that connects every phone, computer, camera, and smart device in your home.

Locked out of your Google or Apple account

Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.

Personal email account hacked

Someone else is in your email, which means they can reset the password on almost everything else you own.

Phone lost or stolen

Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.

Phone number stolen in a SIM swap

Your phone suddenly loses service because someone moved your number to another SIM or mobile provider.

Photos and files lost with no backup

The drive died, the phone went in the water, or the folder is simply gone, and there was never a copy.

Scammed or fraudulent bank charge

Money left your account that you did not authorise, or you were talked into sending it and have just realised.

Social media account hacked

Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.

For businesses

Production systems, customer data, vendors, and the people who keep them running.

Access

9 playbooks

Business email compromised

An attacker may read mail, reset other accounts, impersonate the business, or redirect payments.

Cloud account compromised

An attacker may control cloud identities, infrastructure, data, logs, or the account's billing and recovery settings.

Customer accounts under credential-stuffing attack

Automated attackers are testing stolen username and password pairs against customer accounts.

GitHub organization compromised

An attacker may control an owner account, repositories, Actions, apps, or credentials connected to your GitHub organization.

Laptop lost or stolen

A work laptop containing sessions, source code, customer data, or recovery credentials is missing.

MFA device lost or broken

The phone or security key used to approve critical logins is unavailable, damaged, or stolen.

Package registry account compromised

An attacker may be able to publish malicious versions of packages your customers or systems install.

Password manager locked out

The vault containing business passwords, recovery codes, and secure notes is unavailable or cannot be unlocked.

Production API key leaked

A credential that can read data, spend money, send messages, or control production has been exposed.

Infrastructure

15 playbooks

Background jobs stop processing

Queued emails, imports, billing actions, webhooks, or other asynchronous work is delayed or frozen.

Cloud quota exhausted

A provider limit prevents new requests, instances, storage, messages, builds, or other critical resources.

Cloud region outage

A cloud region or availability zone hosting critical workloads becomes unavailable or severely degraded.

Critical scheduled job silently stops

A cron task or scheduler no longer runs backups, renewals, reports, cleanup, billing, or synchronization.

Database connections exhausted

The application cannot obtain database connections, causing requests, jobs, and administrative access to stall.

Database migration fails mid-release

A schema or data migration partially applies, blocks traffic, corrupts records, or leaves old and new code incompatible.

DDoS attack overwhelms the service

Malicious traffic exhausts bandwidth, connections, compute, or expensive application operations.

DNS change takes the business offline

Incorrect nameservers or DNS records make the website, API, email, or verification services unreachable.

Domain expired or lost

Your domain no longer resolves, has left your registrar account, or is registered to someone else.

Launch produces 20× expected traffic

A launch, mention, campaign, or attack sends far more legitimate traffic than the system was designed to handle.

Monitoring and alerts go blind

Logs, metrics, traces, uptime checks, or alerts stop reporting while production continues to run.

Production deploy breaks the site

A release causes errors, missing pages, failed checkouts, corrupt writes, or unexpected customer behavior.

TLS certificate expired

Browsers or API clients reject your site because its HTTPS certificate is expired, invalid, or issued for the wrong name.

Website hacked

An attacker may have altered your site, stolen data, installed persistence, or gained access to connected systems.

Wrong feature flag enabled in production

A hidden, unfinished, risky, or destructive code path is activated for the wrong customers or environment.

Data

9 playbooks

Backups will not restore

Backups exist, but they are missing, corrupt, incomplete, encrypted, incompatible, or too slow to use.

Customer receives another customer's data

An export, report, attachment, or support response exposes one customer's information to another.

Encryption key lost or unusable

Encrypted customer data, backups, or infrastructure cannot be decrypted because the required key is missing or inaccessible.

Private data appears in a public repository

Customer information, credentials, internal documents, or private source code were pushed to a public repository.

Private storage bucket becomes public

Files intended for restricted access can be listed or downloaded without proper authorization.

Production data deleted

Records, files, tables, or an entire production database were deleted or overwritten.

Production database corrupted

Production records still exist but values, relationships, indexes, or internal storage are no longer trustworthy.

Ransomware or destructive malware

Systems or data are encrypted, stolen, deleted, or held for payment by a malicious actor.

Sensitive data appears in logs

Passwords, tokens, payment details, personal data, or private content are being recorded in application or vendor logs.

Money

5 playbooks

Customers charged twice

A retry, webhook, race condition, import, or operator action creates duplicate customer charges.

Payment webhooks stop processing

Payment events are delayed, rejected, or ignored, leaving orders, subscriptions, and access out of sync.

Stripe payouts frozen

Stripe is still collecting money, but payouts are delayed, paused, failed, or restricted.

Sudden wave of chargebacks

Disputes rise sharply because of fraud, customer confusion, service failure, or an organized abuse campaign.

Unexpected cloud bill

Cloud, AI, storage, bandwidth, or API spending rises far beyond the expected amount.

People

4 playbooks

Contractor disappears

A contractor becomes unreachable while retaining access, knowledge, devices, code, data, or ownership of critical services.

Former team member still has access

Someone who no longer works with the business can still reach accounts, code, data, devices, or customer systems.

Founder unavailable for two weeks

The only person with critical authority, access, or knowledge cannot work or communicate.

Team member leaves without a handover

A key person departs before transferring ownership, context, credentials, work, or recurring responsibilities.

Vendors

8 playbooks

How it works

A small plan you can use under pressure

Choose the incident

Start with the system, provider, or person that is creating the risk.

Prepare or recover

Use the readiness checklist beforehand or follow urgent actions in order.

Verify control

Finish with observable checks that prove the business is actually recovered.