An Account Takeover (ATO) is a security incident in which an unauthorised third party gains full control of a legitimate digital account. The attacker effectively acts as the real owner: they can change credentials, contact details, recovery mechanisms, and security settings.
How it typically occurs
ATOs usually do not rely on sophisticated technical vulnerabilities, but on far more common attack vectors:
- reuse of passwords exposed in previous data breaches,
- compromise of the email account associated with the service,
- phishing or social engineering,
- absence or poor configuration of additional authentication mechanisms.
Why it is critical
Once an ATO is successful, the attacker can:
- lock out the legitimate owner,
- use the account for fraud, spam, or impersonation,
- cause reputational or financial damage.
For this reason, prevention and early detection are just as important as the response that follows.
« Back to Glossary Index
