Calm and ordered

If an account is taken over or you see suspicious activity: secure the device on the network, change passwords from another trusted device, check extra account verification, notify IT/people involved.