PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your cloud storage suddenly shows a large upload you cannot explain

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Pause syncing on the affected devices, then secure the account through the provider’s official app or website. Check recovery details, change the password, sign out other devices and apps, and turn on 2-step verification.

Do not do these things

  • Don’t start deleting lots of files until you have secured the account and noted what you are seeing.
  • Don’t leave the cloud app syncing on affected devices while an unexplained upload is still running.
  • Don’t click “security alert” links from emails, texts, adverts, or pop-ups; go directly to the provider’s official site or app.
  • Don’t reuse an old password or a password used on another account.
  • Don’t wipe or reset devices immediately unless you have first secured the account and noted the key details.
  • Don’t assume one unfamiliar sign-in place proves an attack; locations can be approximate, but they are still worth checking.

What to do now

  1. Pause the upload.
    Pause syncing or quit the cloud app on each device that uses this cloud account. If you cannot find a pause option and the upload is still running, turn off Wi-Fi or unplug ethernet on the device most likely to be uploading.

  2. Open the account safely.
    Use the provider’s official app you already have, or type the provider’s address yourself. Do not use links from warning messages or search adverts.

  3. Check the account that controls password resets.
    Open the email account used for the cloud account. Check for unknown forwarding rules, filters, recovery email addresses, recovery phone numbers, or recent password-reset messages.

  4. Change the cloud password.
    Use a strong, unique password that you have not used anywhere else. If the email account uses the same or a weak password, change that too.

  5. Sign out other sessions.
    In the cloud account security settings, sign out all other devices, sessions, browsers, and connected apps where the provider offers this option. This helps stop access that may still be active.

  6. Turn on 2-step verification.
    Enable 2-step verification for the cloud account and, if possible, for the email account used for recovery. Save any backup codes somewhere safe and not only inside the same cloud account.

  7. Check for ways someone or something could still have access.
    In the cloud service, review:

    • recent activity, device lists, and sign-in history for devices, times, or places you cannot explain
    • connected apps and third-party access
    • shared folders, shared links, and unknown collaborators
    • backup features such as photos, desktop backup, phone backup, scanner upload, or scan-to-cloud
    • recently added or changed files that match the unexplained upload

  8. Make a quick record.
    Take screenshots of the upload activity, unknown devices, changed sharing settings, changed recovery details, or connected apps you do not recognise. Note the date and time.

  9. Check the device most likely to be uploading.
    On a computer, run an up-to-date antivirus or security scan and follow its advice. Apply operating system, browser, antivirus, and cloud app updates when you can do so safely. If this is a work, school, charity, or managed account, stop using the account for new work and follow the organisation’s IT or security incident process.

  10. Use the right UK reporting route if crime, fraud, or money loss may be involved.

  • If there is immediate danger or an emergency, call 999.
  • If a crime is happening now but it is not an emergency, call 101.
  • If you are in England, Wales, or Northern Ireland and you think this is cyber crime or fraud, use Report Fraud.
  • If you live in Scotland, or the incident happened in Scotland, contact Police Scotland, usually by calling 101 for non-emergencies.
  • If bank or card details may be involved, contact your bank or card provider using the number on the card, the official app, or the official website.

What can wait

  • You do not need to decide now whether to permanently delete files, reorganise folders, or close the account.
  • You do not need to wipe devices immediately unless you have clearer signs of infection and have first secured the account.
  • You do not need to message everyone in your contacts now unless you confirm your account shared files, sent messages, or exposed a shared link.
  • You do not need to prove exactly what happened before taking the basic security steps above.

Important reassurance

A sudden large upload can be frightening, but it can also come from a forgotten device, a backup feature, a phone photo upload, a scanner, or a connected app. Pausing sync and securing the account is a sensible first move whether the cause is harmless or not.

Scope note

These are first steps to stabilise the situation and prevent more damage. Later decisions, such as deeper device checks, data-exposure review, provider recovery, bank support, or organisational reporting, may need specialist help.

Important note

This is general information, not legal, medical, financial, therapeutic, cybersecurity, or other professional advice. For work systems, regulated data, or sensitive personal data, use official provider support and your organisation’s incident process.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us