A Hacked Router: Signs That Someone Else Controls Your Router, Why It's Dangerous for the Whole Family and How to Regain Control and Protect Your Home Network

Plenty of people think about the security of their computers and phones, but almost nobody thinks about the router. The provider installed it once, and it has sat in a corner for years, blinking. Yet all the family's traffic passes through the router: banking, messages, work documents, camera footage. If an attacker gains access to the router, they can silently redirect you to fake websites, tamper with downloaded files, open access to home devices and turn your router into part of a botnet attacking other systems. And on the surface everything keeps working. Let's look at how to spot a break-in, why it happens and what to do.

Signs something's wrong with the router

• Certificate errors when opening bank, email or social media sites — the browser warns the connection isn't secure, though it was fine before.
• Strange ads and redirects on every device at once, including phones and the TV, not just one computer.
• Changed DNS servers in the router settings — addresses you didn't enter that don't belong to your provider.
• The admin password no longer works, though you didn't change it.
• New port forwarding rules, remote management switched on, or unfamiliar accounts.
• Unknown devices in the list of connected clients.
• Sudden slowdowns and high router load when nobody at home is actively online.
• A message from the provider about suspicious activity from your address.

No single sign proves a break-in on its own — certificate errors can be caused by the wrong date on a computer, and ads by a browser extension. But if the signs appear on every device at once, the source is often the router.

Why it's dangerous

• Phishing via DNS hijacking. You type your bank's address correctly but land on a fake site where you enter your login, password and SMS code.
• Access to the home network. The attacker sees computers, network drives and cameras and can attack them from inside.
• Use of your internet connection. Hacked routers are recruited en masse into botnets for attacks, spam and proxy networks. The consequences can include websites blocking your address and complaints from your provider.
• Surveillance. The attacker can see which sites you visit and collect data.

Why routers get hacked

Usually not because someone picked you specifically. Automated programs scan the internet around the clock for routers with known vulnerabilities. The main reasons a break-in succeeds are a default admin password like admin/admin, remote management enabled from the internet, firmware not updated for years, old models the manufacturer stopped patching long ago, and features such as WPS and UPnP that make life easier not just for you. Sometimes a router is "hacked" from the inside — for example, through an infected computer on the same network.

What to do if you suspect it

Most importantly, don't use online banking or enter important passwords from devices on that network until the router has been checked. For urgent matters, use your phone's mobile data instead. Simply changing the Wi-Fi password doesn't help if the attacker has altered the router's settings or planted their own changes in it. Proper recovery involves a full router reset, installing current official firmware, setting it up from scratch with new passwords and checking every device on the network. If the router is old and no longer receives updates, it needs replacing. After recovery, change the passwords for important accounts that may have been entered during the compromise, and turn on two-factor protection.

How to protect the router

• A unique long admin password, different from the Wi-Fi password.
• Remote management from the internet switched off.
• Regular firmware updates, or automatic updates.
• WPS and unnecessary features turned off, with no extra open ports.
• WPA2 or WPA3 encryption and a strong Wi-Fi password.
• A separate network for guests and smart devices.
• Replacing the router once the manufacturer has ended support.

What our technician does

1. Checks the router settings: DNS, port forwarding, accounts, remote management and firmware.
2. Looks for signs of infection on computers and other devices on the network.
3. Resets the router and installs official firmware, or selects a new router.
4. Sets everything up again with strong passwords, disables risky features and separates networks.
5. Helps change important passwords and enable two-factor protection, and explains how to keep things secure.

A real example

An elderly couple in Varketili called us after intrusive ads started appearing on all their devices, and the browser showed a security warning when they logged in to online banking. Their son had already reinstalled Windows twice, but the problem kept coming back. Our technician found foreign DNS servers, remote management switched on and the default admin password on their seven-year-old router. No updates had been released for that model in years, so we replaced the router with a modern one, set it up with unique passwords and no remote access, checked the computers and helped change the online banking password. The ads disappeared, and the bank opens without warnings.

Call a technician

If you suspect your router has been hacked, or want your home network's security checked, we'll come to any district of Tbilisi around the clock. Learn more on our router setup, router repair and virus removal pages.