// first 10 minutes

smart home compromise — quick-start

smart home compromise — first 10 minutes. change credentials before logs rotate. print this, check boxes, then run the primary tools.

checklist

change the password on the smart home hub account (Google Home, Amazon Alexa, Apple HomeKit) immediately — these control all devices.
revoke all third-party integrations and linked apps from the hub account — OAuth access is the most common attack vector.
pull the activity log / history from each affected device: camera, lock, doorbell, thermostat — timestamp the export.
check for new or renamed routines, automations, or schedules that the attacker may have created.
check whether any device PIN codes were changed (door locks, garage openers) — attacker may have added their own.
export the smart speaker voice history (Alexa history, Google assistant activity) for the incident window.
check home router DHCP lease table for unrecognized devices that may have joined the network.
photograph or screenshot the device list in the hub app — note any device the victim does not recognize.
check if the hub account has any new authorized users or family-member invitations the victim did not create.
begin the primary tool path below — smart home access log analyzer.