Your Reinstall Did Not Revoke the Stolen VPN Credentials

Wiping a compromised laptop feels like the end of the incident. It is usually the middle. A password, a session token or an exported VPN profile copied off that machine survives the reinstall completely intact, because nothing about formatting a disk reaches the server that accepts it. Device recovery and account recovery are two jobs with different clocks.

Two incidents, two clocks

The device work is local and fast: rebuild, patch, restore data. The account work is remote and slower, because it depends on what the provider exposes and on whether you still control the recovery channel. Doing the fast job first feels productive and leaves the actual exposure exactly where it was.

Treat the laptop as untrusted until the account work is done. Using it to perform account recovery means using a machine that may already have a keylogger on it.

Three conditions that set the order

Work these out before you touch anything, because they decide whether recovery takes fifteen minutes or a support escalation.

First, what was on the device: a password you typed, a client certificate with its private key, a saved session token, or all three. Second, what the provider lets you revoke yourself, since some services expose device and session lists while others offer a password box and nothing else. Third, whether the recovery channel is still yours, meaning the mailbox and phone number attached to the account. If the third is compromised, everything else waits.

Write the answers down. An incident where you cannot say what was copied is an incident you cannot close.

Replace what can be replayed

Anything replayable has to be replaced, not just changed on the new machine. Passwords, device certificates and exported profiles all qualify. NIST's authenticator lifecycle guidance describes promptly invalidating a compromised authenticator and requiring independent notice when another authenticator is bound, which is the right shape of the job even where a consumer VPN exposes fewer controls.

Then terminate sessions. A password change does not reliably invalidate existing tokens, and a VPN profile already installed on another machine keeps working until its credential is revoked. Check what the service documents rather than what you hope it does.

Rebuild without restoring the compromise

Reinstalling is the easy part, and it is where people undo their own work. Restoring a full backup can bring back the same saved profile, the same browser session and the same credential store. Review what the restore actually imports, then enroll the device fresh through the supported flow with newly issued material.

Keep devices separately removable where the service allows it. One profile per device is the detail that turns a future incident into a single revocation instead of a fleet-wide scramble.

Decide when the incident is over

It is over when three things are true. Legitimate access works from the rebuilt device. The exposed identities have been retired through controls you can actually see. And the remaining recovery methods, the mailbox, the phone number, the backup codes, belong to you. A clean install that connects satisfies only the first.

If you cannot inspect or remove an unexpected authenticator or recovery contact, escalate through the verified support process. Reinstalling locally will never fix a recovery method that somebody else controls.