PanicStation.org
UK USA
us Technology & digital loss

What to do if…
your cloud storage suddenly shows a large upload you cannot explain

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause syncing first, then secure the account through the provider’s official site or app. Sign out other sessions, change the password, turn on two-factor authentication or multi-factor authentication, and check for unknown devices, apps, and sharing.

Do not do these things

  • Don’t mass-delete files or “clean up” the cloud account before you have secured it and captured what you are seeing.
  • Don’t leave sync running while you check the account if you can safely pause it.
  • Don’t use security-alert links from emails or texts; go directly to the provider’s official site or app.
  • Don’t reuse an old password or a password used on another site.
  • Don’t immediately factory-reset devices just because the upload looks suspicious; secure the account first and save key details.

What to do now

  1. Pause the upload path.
    Pause syncing or quit the cloud app on every device that uses the account. If you cannot pause sync on a device, disconnect that device from the internet while you secure the account.

  2. Sign in the safe way.
    Open the cloud provider’s official app or type the provider’s web address yourself. Do not follow links from warning emails, texts, pop-ups, or search ads.

  3. Sign out other sessions.
    In the account security settings, use “sign out of all devices,” “sign out of all sessions,” or the closest available option. This can help stop someone who is already logged in.

  4. Change the password and turn on extra login protection.
    Set a strong, unique password that you do not use anywhere else. Turn on two-factor authentication, multi-factor authentication, 2-step verification, or passkeys if the provider offers them. Also secure the email account used for password resets.

  5. Check recovery and security settings.
    Review the recovery email, phone number, backup codes, trusted devices, remembered browsers, and security-alert settings. Remove anything you do not recognize and save new backup codes if the provider offers them.

  6. Look for the source of the large upload.
    In the cloud service, check recent activity, sign-in history, device lists, connected apps, shared folders, shared links, and collaborators, if those settings are available. Remove unknown apps, devices, links, and collaborators. Also check whether photo backup, desktop backup, scanner uploads, or another backup feature has started uploading an old backlog.

  7. Capture a small record before changing more.
    Take screenshots showing the upload size, time, file or folder names, unknown devices, unknown apps, and any changed recovery details. Write down today’s date and the approximate time you noticed the upload.

  8. Check devices that sync to the cloud.
    On computers that sync to the account, run the built-in or installed security scan, update the operating system and cloud app, and reboot. If this is a work, school, or managed account or device, stop personal troubleshooting and follow that organization’s IT or security incident process.

  9. Use official reporting routes if there may be crime, fraud, or identity theft.
    If there is substantial financial loss, extortion, ransomware, or a clear cyber-enabled crime pattern, you can file a report with the FBI’s IC3. If Social Security numbers, financial accounts, tax information, or other personal information may be misused, use IdentityTheft.gov for recovery steps.

What can wait

  • You do not need to decide right now whether to permanently delete files, rebuild your folder structure, or notify everyone you know.
  • You do not need to buy security software in the moment; stopping sync and securing account access come first.
  • You do not need to wipe devices immediately unless a trusted professional or your organization’s IT process tells you to do that.

Important reassurance

A sudden large upload can come from a legitimate backup setting, an old device reconnecting, a photo or desktop backlog, or an app you previously allowed. Treat it as suspicious until checked, but the first steps are the same: pause sync, secure the account, and remove unknown access.

Scope note

These are first steps to stabilize the situation and reduce harm. If you confirm unauthorized access, later decisions may need help from the cloud provider, workplace IT, a cybersecurity professional, identity-theft recovery resources, or law enforcement.

Important note

This is general information, not legal, medical, financial, therapeutic, cybersecurity, or other professional advice. If workplace systems, regulated data, or sensitive personal information are involved, use official provider support and your organization’s incident reporting process.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us