What to do if…
a password manager shows unexpected vault changes or missing entries

What to do now

1. Pause changes on other devices.
   Close the password manager on your other devices. If one device keeps showing unexpected changes, temporarily take that device offline while you review the account.

2. Review the password-manager account from one device you reasonably trust.

   • Open the provider’s official app or type its website address yourself.
   • Check the available device, session, login, or security-activity pages for anything you do not recognize.
   • Use any available option to sign out unfamiliar sessions.
   • Change the master password or account password if compromise seems possible and the provider’s official instructions support doing so.
   • Turn on multifactor authentication (MFA), or confirm that it is still enabled, if the provider offers it.
   • Check that any listed recovery email address and phone number are still correct.
   • Replace recovery codes if the provider offers that option and you believe old codes may have been exposed.
   • Contact official provider support if the correct order is unclear or you are worried about being locked out.

3. Record what you can see without exposing secrets.
   Note when you first noticed the problem, which entries are missing or changed, any alerts, and any unfamiliar devices or sessions. Redact passwords, recovery codes, one-time codes, and full account identifiers before saving or sharing screenshots.

4. Review recovery options before using them.
   Look for trash, deleted items, item history, previous versions, restore options, sync-conflict notices, or account rollback tools. If a restore could overwrite current data, ask official provider support before continuing.

5. Check whether another authorized person changed a shared vault.
   For a family, work, or shared vault, check whether another member or administrator made the changes. Review any available activity log before restoring items.

6. Secure the connected email account and check the device.
   Use a new password and MFA for the email account connected to the password manager if compromise seems possible. Review recent email sign-ins. Update the operating system and browser, and run a reputable security scan if you see signs of device compromise.

7. Protect accounts that can unlock other accounts.
   If passwords may have been exposed, start with your primary email, financial accounts, mobile carrier account, and main Apple, Google, or Microsoft account. Use a device you reasonably trust and enable MFA where available.

8. Use the appropriate official reporting route if needed.
   Contact your bank, card issuer, or payment provider promptly if you see unauthorized transactions. Use IdentityTheft.gov if you think someone is using your personal information for identity theft. Use IC3 if you believe you have been affected by cyber-enabled crime or fraud.