The first 48 hours after leaked content appears online are about containment.
Preserve evidence, remove obvious copies, slow redistribution and avoid actions that make the material easier to find.
Hour one: preserve and prioritise
- Capture URLs, usernames, timestamps, page titles and platform details.
- Prioritise indexed pages, high-traffic accounts, forums and search results.
- Keep sensitive evidence in a secure, access-limited location.
Day one: remove main distribution points
Start with the source platform, visible mirrors, search results and accounts amplifying the material. The best policy route depends on whether the issue is copyright, intimate imagery, impersonation, personal data or harassment.
Day two: monitor for re-spread
After initial takedowns, search monitoring and re-upload checks become the priority. A single reporting log helps prevent duplicate reports and lost evidence.
Key takeaways
- Capture evidence before reporting, but control access to sensitive files.
- Use the right policy pathway for each platform.
- Plan for re-uploads from the beginning.
This resource is general information, not legal advice. Outcomes vary by platform policy, evidence, jurisdiction, content type and the facts of the matter.