Zoom account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Zoom’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
The "Zoomsday" zero-click flaw: update the app first
On August 11, 2026 Zoom patched a bug in the meeting annotation feature that let one participant run code on another participant's machine with nothing required from the victim. Zoom rates it high severity (CVE-2026-53413, CVSS 8.3), and the researchers who reported it named it Zoomsday. The fix is a client update: Zoom Workplace 7.1.5, or 7.0.6 if you are kept on the older track, with separate builds listed for Rooms, the Meeting SDK and the VDI client. This was a flaw in the software, not a break-in at Zoom, so no accounts or passwords leaked because of it, and Zoom's advisory does not report anyone being attacked through it. If your Zoom account itself was taken over, that is a different problem and the recovery steps below are the ones you want.
Zoom security bulletin ZSB-26015, published August 11, 2026, plus press coverage of the disclosure.
If your Zoom account was hacked: start recovery at the official page (support.zoom.com/hc/en), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Zoom account, step by step
These steps follow Zoom’s official process. Official links only: account recovery · password reset.
Reset the password (or secure the linked Google/SSO account used to sign in).
Sign out of all devices in account settings and revoke unknown connected apps.
Enable two-factor authentication and review cloud recordings/contacts for exposure.
For business accounts, alert your Zoom admin - takeovers can pivot into meeting hijacking.
What trips people up with Zoom
- Zoom takeovers are heavily credential-stuffed from other breaches - if you signed in with Google/Facebook/SSO, secure that provider first, since Zoom cannot reset what it does not own.
- Check cloud recordings after recovery: an attacker with your account can download meeting recordings and contact lists, which is the real data loss here.
Was Zoom hacked? What "Zoomsday" actually was
No, and the distinction matters if you are trying to work out what to do. Nothing was stolen from Zoom and no set of Zoom logins was published. What happened on August 11, 2026 was a patch. Zoom fixed a bug in the annotation tool, the feature that lets people draw on a shared screen, where a missing bounds check meant a participant could send a crafted annotation message that wrote past the end of a buffer and finished by executing code on someone else's computer. The victim did not have to click, open or accept anything, which is what zero-click means and why the story travelled as far as it did.
Three related issues were fixed in the same round: a use-after-free in the annotator that could also lead to code execution, a similar bounds problem that could knock a participant offline, and a path-traversal bug that leaked information. Zoom's own bulletin lists the fixed builds and does not report exploitation before the patch. The detail that pushed the story past the security press was how the bug came to light: the researchers said they reconstructed a working exploit using publicly available AI models in under a day, and reporting at the time put it at roughly twenty prompts.
So the practical read is short. Update the client and the hole is closed, and there is nothing to check afterwards, because a software flaw does not put your email or password anywhere. Searches spike around a story like this partly from people who had something else happen: a Zoom login that no longer works, meetings appearing on the calendar that nobody booked, a cloud recording downloaded by someone who should not have it. That is an account takeover, and it usually starts with a password reused from some other company's breach. The recovery steps on this page are for that.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Zoom's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Locked out of Zoom — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Zoom's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Zoom sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Got a "new login" alert from Zoom?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Zoom). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Lost your 2FA device or codes
If you changed phones or lost access to your authenticator, use the backup codes you saved when enabling 2FA — that's exactly what they're for. No backup codes? Zoom's account-recovery flow (link above) can verify you through other signals — original signup details, linked email, purchase history or ID verification — but it's deliberately slow, since the same door would otherwise let attackers in. Start the process immediately and respond fast to any follow-up; recovery requests that go quiet get closed.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Zoom (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Zoom itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Zoom account, answered
How did my Zoom account get hacked?
The most common cause isn't a hack of Zoom itself — it's credential stuffing: a password you used on Zoom leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Zoom login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Zoom account back?
Usually yes. Use the official recovery flow (https://support.zoom.com/hc/en) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Zoom account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Zoom can lock it, before you start over.
What is the Zoomsday vulnerability?
Zoomsday is the nickname the finders gave CVE-2026-53413, a flaw in the annotation feature of Zoom clients that Zoom patched on August 11, 2026. A missing bounds check let a meeting participant send a crafted annotation message that overwrote memory on another participant's device and ran code there, without the victim clicking anything. Zoom rated it high severity at CVSS 8.3. It was a bug in the app rather than a break-in, so no Zoom account data leaked as a result.
Do I need to update Zoom?
Yes, and it is the only thing this particular story asks of you. Zoom Workplace 7.1.5 carries the fix, and 7.0.6 covers the older track that some organisations stay on; Rooms, the Meeting SDK and the VDI client have their own patched builds in the bulletin. Check the version under your profile menu and take the update from Zoom's own download page or the in-app updater, never from a link in an email about the flaw.
Is Zoom safe to use after the Zoomsday flaw?
On a patched client, yes. The attack needed the victim to be in a meeting with the attacker, and Zoom's advisory does not report anyone being attacked through it before the fix shipped. What is worth doing while you are in the settings anyway is turning on two-factor authentication, because the way Zoom accounts actually get taken over has not changed: a password reused somewhere that leaked.
Was my Zoom account hacked because of the Zoomsday bug?
Very unlikely, and the symptoms would look different. That flaw targeted the device of someone sitting in a meeting, not the account database. If you cannot sign in, if the account email or password changed without you, or if recordings and contacts were touched, you are looking at a takeover through stolen credentials. Start with the official recovery flow on this page, then check whether the password you used appears in known breach data.
Which Zoom version fixes CVE-2026-53413?
Zoom Workplace 7.1.5 and 7.0.6, with separate patched versions for Zoom Rooms, the Meeting SDK and the Windows VDI client and its plugins. The bulletin ZSB-26015 lists them per product and platform, and it is the reference worth using rather than a summary, including this one, because the build numbers differ between tracks.
How do I stop my Zoom account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.