Your course just leaked: what to do in the first 24 hours

In the first 24 hours after a leak, capture evidence, contain the source, trace the account, then take copies down and tell people. Name one person to run it and keep a log. Don't contact the channel admin, and don't accuse anyone publicly. A source left open keeps feeding new copies, so containing it matters as much as removing them.

First ten minutes: how serious is it?

Check two things before anything else. Is it really your paid content, and not a free demo or a teaser you posted yourself? And is it still happening? Then decide how big a response it needs:

A "high" leak is the one to fear most. New lectures appearing within hours point to an account that is active right now, and every class you release before it's found will follow.

Hour 0 to 1: one owner, evidence first

Put one person in charge, with the authority to suspend accounts and speak for the institute. In a larger institute, split the work: one person on evidence, one on the platform and account records, one on messages to staff and students. In a small one, it may all be you, which is fine as long as it's written down.

Then capture before you report. Once you file a takedown, the channel and files may vanish, and your evidence goes with them. Save the links, the files themselves, screenshots showing dates and any price or UPI ID, and a screen recording scrolling through the channel. Hash each file as you save it. Our guide to preserving digital evidence of a leak explains how, and why it matters if the case reaches court.

Open a simple log at the same time: what was found, where, when, by whom and what was done. Everything later in the day goes into it.

Contact your platform's support in the first hour, too. Whoever runs your videos can pull account records, check watermarks and help suspend accounts, and they work faster with a head start.

Hours 1 to 4: contain the source

Takedowns remove copies; containment stops new ones. Start by looking at the leaked copy for clues to how it was made, then act on what you find:

• A visible watermark names an account. Suspend that account now, and keep all of its records. Suspension is reversible; another week of leaked lectures isn't.
  
  
• The copy is raw or unreleased footage. Treat it as an insider leak. Review who had the originals, freeze exports and remove access for anyone who has left.
  
  
• The copy has no mark and full quality. Look for a side door: an old download link, an unprotected preview, an old app version or a shared folder. Close it.
  
  
• PDFs leaked with the videos. Check whether they carry a student's details. A marked PDF is often the quickest trace of all.
  
  
• A test paper or answer key leaked. Replace the paper or move the test, and tell students why. Our guide to preventing question paper leaks covers how to stop it happening again.
  
  

Then protect the next release. If new lectures leak within hours and the account isn't yet identified, consider holding the next lecture for a few hours while you trace. It costs students a short wait; releasing on time may hand the leaker another lecture. Change any shared staff passwords on the same day.

Hours 4 to 12: trace, then take down

Trace the account

Read any visible watermark across several frames. Then send the best copy you have to your platform to check for invisible watermarks. Next, compare the lead with account records: did that account watch the leaked lectures shortly before they appeared, and from which devices? Remember that a trace identifies an account, not always the person holding the phone.

Send takedowns, source first

With evidence saved, report the source channel first, then the file lockers it points to, then re-uploads and search results. Removing the source stops new links; removing files breaks the old ones. Our guides to removing leaked course content and reporting a Telegram channel for copyright cover each platform. Telegram's FAQ says it doesn't process requests about private groups and chats. A leak in a private group usually needs a court order rather than a report.

Hours 12 to 24: tell the people who need to know

Silence lets rumours fill the gap, but over-sharing spreads the leak. Tell each group only what it needs:

• Staff and faculty: what happened, that nobody should discuss it in public or student groups, and who speaks for the institute.
  
  
• The account holder: a written notice that the account is suspended, what was found and a date by which to explain. Copy a parent if the student is a minor.
  
  
• Paying students: a short, factual message. Say that you found and reported copies, that every video and PDF is tied to the student's account, and where to send links. Don't name anyone, and don't post the leak's link.
  
  
• Students in a test series: if a paper leaked, a clear note on what changes, such as a new paper or date, and why.
  
  

Before the day ends, decide on escalation. A first leak by one student usually ends with suspension under your terms. A seller, a repeat leaker or a known ex-employee may justify a lawyer's notice; see our guide to sending a legal notice for copyright infringement. Knowingly sharing a course without permission is an offence under section 63 of the Copyright Act, 1957. This is general information, not legal advice.

Mistakes that make a leak worse

• Reporting before capturing, so the evidence disappears with the channel.
  
  
• Messaging the channel admin, negotiating, or paying anyone who offers to "remove leaks" for a fee.
  
  
• Deleting the suspected account instead of suspending it, which destroys the records you need.
  
  
• Posting the leak's link in your own groups to warn students, which advertises it.
  
  
• Naming or shaming a student in a batch group before the facts are clear.
  
  
• Threatening the whole batch, which punishes honest students and rarely finds the leaker.
  
  
• Sending lectures as links as a temporary fix while the app is "being secured".
  
  
• Treating takedowns as the end. Copies come back while the source is open.
  
  

The 24-hour checklist

1. Confirm it's your paid content and grade it: low, medium, high or critical.
   
   
2. Name one person in charge and open a log.
   
   
3. Capture links, files, screenshots and a scroll recording; hash every file.
   
   
4. Read the copy for clues: watermark, raw footage, missing mark or a test paper.
   
   
5. Suspend any account a watermark names, keeping its records.
   
   
6. Close side doors, freeze exports and change shared staff passwords.
   
   
7. Replace or reschedule any leaked test.
   
   
8. Send the best copy to your platform for watermark checks; compare with account records.
   
   
9. Report the source channel, then lockers, re-uploads and search results.
   
   
10. Brief staff; write to the account holder; message students without names or links.
    
    
11. Decide whether to escalate, and note the decision in the log.
    
    
12. Book a review in a week: is the source closed, and have copies come back?
    
    

Want fewer leaks to chase, and a quicker trace when one happens? VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. It also brings VidSafe proprietary encryption, screen- and camera-recording detection, account-sharing prevention, PDF watermarking and RASP. See Upclass plans and pricing.

Frequently asked questions

What should I do first if my course is leaked?

Save the evidence before you report anything: the links, the leaked files, screenshots with dates and a recording of the channel. Then look at the copy for a watermark or other clues to the source, and suspend any account it points to. Takedowns come after, because a reported channel can disappear along with your proof.

Should I suspend the student's account straight away?

If a watermark clearly names the account and new lectures are still leaking, suspending quickly is usually right, because it stops the next leak. Suspend rather than delete, so the records survive, and give the account holder a written chance to explain before any final decision.

Can I get a course removed from a private Telegram group?

Not through a normal report. Telegram's FAQ says it doesn't process requests related to private groups and chats. Leaks there usually need a court order, which is one reason tracing the account that supplied the group matters so much.

Should I tell my students about the leak?

Usually yes, briefly. Paying students often notice leaks, and silence can look like indifference. A short message that copies were reported, that every video is tied to the student's account and where to send links works better than a long warning. Never name a suspected student or share the leak's link.