Community members cannot access account records, so GitHub Support is the only authority that can restore your account. While waiting for their response, take these critical containment steps immediately:

1. Contain the Blast Radius Immediately

• Secure your email account: If the attacker changed your GitHub email, check your inbox for unauthorized logins, forwarding rules, or deleted GitHub security alerts. Change your email password and enable 2FA on that email provider.
• Revoke active keys locally: If you have access to systems using your SSH keys, personal access tokens (PATs), or API secrets linked to that account, revoke or rotate them immediately.
• Alert team members/orgs: If you belong to any GitHub organizations, notify the organization owners immediately so they can remove your compromised account and protect shared repositories.

2. Follow Official Compromised Account Procedures

• Submit an incident report specifically via [GitHub Support - Compromised Account](https://www.google.com/search?q=https://support.github.com/contact/report-abuse%3Fcategory%3Dreport-abuse%26report_type%3Dunauthorized_access) if you only opened a generic ticket.
• Gather verification proof to reply to support:
• Original email address and GitHub username.
• Recent commit GPG key fingerprints or SSH public key hashes associated with your account.
• Payment details (last 4 digits of billing card or transaction IDs) if you had GitHub Pro, Copilot, or Sponsors.

What to Expect Next

• Account takeover tickets are high-priority, but manual verification can take 24–72 hours.
• Do not submit duplicate tickets, as this can reset your queue position. Reply directly to the existing confirmation email if you have additional verification evidence to supply.