Is there any way to know how much of my data was exposed? Or stolen? Can I know if they really got my pictures? Or anything else?
This will depend on your operating system and what behaviour gets
logged automatically. That you knew that you were hacked indicates the
hacker wasn't covering their tracks very well.
Still, most service accounts when someone logs in will provide carte
blanche access to all assets. So if a specific account was breached -
assume they took everything. Otherwise it will depend on how much security logging the computer or online web service did and whether
anyone will want to check these often cryptic audit logs for free.
Is there anyway to secure my network?
Yes. Many ways to secure a network. Too many list here. But you can start with this guide.
Or do I have to close my email accounts and change my laptop?
No - you don't need to close your accounts or sell your laptop. But you do need to reconfigure your accounts and laptop.
For your computer
- Install malware/virus scanner and check that no corrupt apps exist
on your laptop. You need to do this first to ensure no corrupted
backup tool re-injects viruses/trojans.
- Restore your computer from a full backup prior to the breach date
(if known); or if no full backup available: Backup everything
except applications or anything that executes code; then factory wipe/reinstall your laptop to the original clean operating system
and then reinstall applications from clean read-only or internet
sources. Then restore backed up data.
- Install a decent firewall and anti-virus solution.
- (Optional) Request your ISP to provide a different static or
sticky-dynamic IP for your computer so that the prior attacker can't
easy find you any more. This can be useful if they were targeting your
computer specifically
For online services (email, gaming, forums, digital storage, social
networking, etc). Assumes that you do this from an uncorrupted computer:
- Get a good strong password manager.
- Log into each breached account (if you can; otherwise contact the
provider)
- Change the password with one generated by the password manager.
Longer is better, and never use the same password on two different
sites.
- Change any secret security questions if you can. Opt for nonsense questions or answer if you can. e.g. Q: What is your mother's maiden
name? A: E-S-V-F-H-N
- Check that your email address for the account hasn't been changed.
As many services send password reset links to your account's email
address.
- Check for any tweaked or altered security settings, such as
authorised third-party apps, client certificates, public keys, email
forwarding, account visibility/privacy settings.
This can be tedious, so it is up to you whether you wish to do this yourself or pay an expert to do it. If the time and materials (money) for doing this exceeds the cost of a new laptop and porting content across, then you could resort to truly clean slate of new equipment.
