Back to Sexting Guide

Leaked Sexts Response Guide: The 72-Hour Containment Protocol

If your intimate content has been leaked, what you do in the first 72 hours shapes everything that follows. Work through these phases in order and do not skip the first one.

Do not contact the leaker, pay any demand, or delete the original evidence

Contacting the person who leaked the content, or paying a demand, almost always makes things worse and marks you as a target. And once you start deleting, you lose the evidence that platform reports and the police need. Document first, then act.

72-hour protocol

The Containment Protocol, Step by Step

Each phase builds on the last. Locking down evidence before you report is what makes every later step hold up with platforms and the police.

Hour 0 to 2

Evidence lockdown

Screenshot the leak source with the full URL, timestamp, and account details visible in the same frame.

Map where it has spread: who received it and where it has been reposted.

Archive the leaker's profiles before they can delete anything.

Coordinate safely: use a separate, secure email for your response, and consider a VPN.

Preserve your device. Do not factory reset it, as it may hold forensic evidence.

Day 1

Platform takedown blitz

Report to every platform at once. Speed determines how much you contain.

Snapchat and Instagram: use the non-consensual intimate image and private-information report paths.

Twitter/X: report targeted harassment and doxxing, and request a legal hold.

Adult sites: file DMCA takedowns and terms-of-service violation reports.

Group chats: request admin removal and report the participants who reshared.

Week 1

Legal escalation and suppression

File a police report (Article 139h in the Netherlands) and send preservation demands so platforms cannot delete evidence.

Send a cease and desist to any identified distributors.

Register the images with StopNCII.org to hash-block re-uploads across major platforms.

Run a reverse image search on every variant, including different crops and backgrounds.

Push down any remaining results by publishing positive, higher-ranking content.

What to expect

Expected Recovery Timeline

With the protocol followed in order and reports filed in parallel, most cases recover on a predictable curve. Professional removal typically costs between €3,000 and €18,000 depending on how far the content spread.

24 hours

Around 60% of content removed from platforms that respond fastest.

Week 1

About 85% of the surface web cleaned through takedowns and hash-blocking.

Month 2

Roughly 95% of the first page of Google restored through suppression.

To reduce the chance of a future leak, see safe sexting and leak prevention, or return to the complete sexting guide.

Child safety

If the Victim Is Under 18

This protocol is for adults. If the person in the content is under 18, it is child sexual abuse material and a criminal matter that must go to the authorities, not a removal service.

Report under-18 content to the authorities immediately

Use Take It Down (takeitdown.ncmec.org) to hash-block the images for free, report to the NCMEC CyberTipline and your local police, and in the Netherlands contact Offlimits.nl. Do not pay anyone, do not forward the content, and do not use a commercial removal service.

Key takeaway

What you need to know

Document before you do anything else

Evidence captured before reporting is what platforms and the police need. Screenshot everything first, then block and report.

Report everywhere at once

Parallel takedowns across every platform remove around 60% of content within 24 hours. One platform at a time lets it keep spreading.

Never pay and never engage

Payment confirms you are a viable target and does not delete anything. Silence, documentation, and reporting are the correct sequence.

Need urgent help?

Time is critical with a leak. Leakserv runs the full protocol for you: evidence, multi-platform takedowns, hash-blocking, and search suppression, with monitoring for reappearance.

Get help nowGet help now