Account Compromised – Password Changed and Unauthorized 2FA Enabled

[ahmadrazadev875-hue]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Body

GitHub Account Compromised - Password Changed and Unauthorized 2FA Enabled

Hello everyone,

I would like to ask for advice from anyone who has experienced a similar situation.

My GitHub account was compromised. I received an email from GitHub notifying me that my password had been changed, and about one minute later I received another email stating that two-factor authentication (2FA) had been enabled. I did not perform either of these actions.

Current situation:

• My GitHub username: Ahmad-Raza810
• I still have full access to the email address associated with the account.
• I have already changed the password for my email account.
• I cannot sign in because GitHub now asks for a 2FA code that I do not have.
• I have already submitted a support ticket to GitHub.

I also suspect that my Windows computer may have been infected with malware after I downloaded software from an untrusted source, so I am currently scanning my system and securing my other accounts.

I understand that only GitHub Support can recover an account in this situation. My questions are:

1. Has anyone successfully recovered a GitHub account after an attacker changed the password and enabled 2FA?
2. Approximately how long did GitHub Support take to respond?
3. What information or verification did GitHub request to confirm account ownership?
4. Is there anything else I should do while waiting for GitHub Support to respond?

I appreciate any advice or experiences you can share.

Thank you.

[tobiager]

Hi @ahmadrazadev875-hue,

I am really sorry to hear this. Falling victim to malware (specifically an infostealer that hijacks your browser session cookies) is incredibly stressful. However, you've already handled the immediate steps perfectly by securing your email and opening an official support ticket.

To answer your specific questions and give you some peace of mind:

1. Can an account be recovered after an attacker changes the password and enables 2FA?

Yes, absolutely. GitHub Support deals with this exact scenario daily. Since you still have full access to the primary email address and acted quickly, your chances of a successful recovery are very high. GitHub's internal security team has the authority to completely remove the unauthorized 2FA and restore your access once ownership is verified.

2. How long does GitHub Support take to respond?

Because account compromises require strict manual verification to ensure the account goes back to the rightful owner, it typically takes anywhere from 3 to 10 business days.
⚠️ Important: Do not open duplicate tickets or bump the thread constantly, as this can inadvertently reset your position in the support queue.

3. What verification will GitHub ask for?

To prove you are the true owner, GitHub Support will likely ask you for technical evidence that an attacker wouldn't have. Be prepared to provide:

• SSH Keys: They may ask you to confirm the public SSH keys associated with your account or to verify a key you used to push code from your local machine.
• Billing Information: If you ever paid for GitHub Pro, Copilot, or any marketplace tools, verifying the billing details (like the last 4 digits of the card) is an instant proof of ownership.
• Historical Data: They might ask about the names of private repositories, original account creation date, or old usernames.

4. What else should you do right now while waiting?

Since your PC was likely infected with malware, your active sessions for other websites are also at risk. Take these steps immediately:

• Check Email Forwarding Rules: Go to your email settings (Gmail/Outlook) and check your filters/forwarding rules. Attackers often set up silent rules to automatically delete or forward emails from github.com so you don't see support replying to you.
• Perform a Clean Boot/Scan: Disconnect the infected PC from the internet. Run a deep offline scan using a reputable tool like Malwarebytes. If it was an infostealer, the safest and most recommended route is a fresh reinstall of Windows.
• Secure Other Accounts: From a clean device (like your smartphone), change passwords and check active sessions for your bank, Google, Discord, and other critical accounts.

Hang in there! You’ve done the right things so far. The wait is the hardest part, but the GitHub team will help you get your profile back.

[ahmadrazadev875-hue]

While checking my profile from another GitHub account, I noticed that my account (Ahmad-Raza810) is now marked as Suspended. This appears to have happened after the unauthorized password change and unauthorized 2FA enablement. I believe the suspension may be related to the compromise. I still own the original email address associated with the account and request assistance in recovering and restoring my account.

[ahmadrazadev875-hue]

Update (More than Two Weeks Later)

Hello everyone,

I wanted to provide an update regarding my GitHub account recovery and ask for some guidance.

It has now been more than two weeks since I submitted GitHub Support Ticket #4527956 regarding my compromised account.

What happened

On July 1, 2026, I received two security emails from GitHub:

• My password was changed without my authorization.
• About one minute later, two-factor authentication (2FA) was enabled.

I did not perform either of these actions.

I still have full access to the original email address associated with the account and secured it immediately by changing its password.

Current status

• GitHub username: Ahmad-Raza810
• Support Ticket: #4527956
• Initially my profile showed as Suspended.
• It now returns 404 Not Found when visiting my profile.
• My support ticket still contains only my own comments.
• I have not yet received any reply from a GitHub Support engineer.

I have intentionally not opened duplicate support tickets because I understand that doing so is discouraged.

I still have:

• Access to the original email account.
• Local copies of all my Git repositories.
• Local Git commit history.
• GitHub security emails showing the unauthorized password change and 2FA enablement.

I am ready to provide any additional verification GitHub Support requires.

My question

Has anyone experienced a similar delay with an account compromise case?

• How long did it take before GitHub Support responded?
• Is there any official way to request a status update or escalation for an existing support ticket without opening a duplicate ticket?

@tobiager
@maheerCode
@roohan-514
@v-ember

I apologize for mentioning a maintainer directly. I completely understand that only GitHub Support can recover an account. I am only looking for advice on the proper process for following up on an existing support ticket after more than two weeks without a response.

Thank you.

[v-ember]

Hi @ahmadrazadev875-hue ,

This community is managed by GitHub employees, but it is not a support forum. You have done everything necessary on your end by opening a ticket on our Support page.

This is a public forum, and the community is unable to assist with nor escalate your ticket, but we can assure you it is in the right place. There are an extremely high volume of Support tickets right now, yours will be answered in the order it was received based on the amount of tickets ahead of yours. Please open only one ticket per request.

As no other Community Discussions team members will be able to provide additional help with account related questions I am going to close this discussion. We appreciate your understanding and patience while Support works through your request!