Google Ads Change Log After a Hack: Which Option to Pick

The Google Ads change log after a hack is the most important decision you will make. Google asks you to decide what to do with every flagged change, and you cannot undo your choice. This guide explains the three options and how to pick the right one.

What is the Google Ads change log after a hack?

After Google secures your account, it creates a list of changes made during the incident. Google emails it to administrators who held their roles before the confirmed compromise date. The compromised user does not receive it.

However, you must re-authenticate first. Google requires 2-Step Verification and a new Google account password before you can review the log or submit a decision.

Which option should you choose in the Google Ads change log after a hack?

• “Clean up this account”: The system reverts the flagged changes. Choose it only if every change was malicious. It is one of the two options that keep you eligible for reimbursement.
• “Restore this account as is”: Choose it only if the changes were legitimate. Google says this confirms no hijacking occurred, so the event is not eligible for reimbursement.
• “Additional investigation is needed”: Choose it if you approve some changes but others need review. The account goes to Google’s support team.

What happens after you submit the decision?

• Google says you cannot change a decision once you submit it.
• If your account has more than 100 flagged changes, Google gives you a link to a full report.
• Google erases manual edits that you make while the decision is pending.
• If the hacker only changed users or campaigns, Google unsuspends the account as soon as it secures it.
• If the hacker changed the account structure, the account stays suspended until an authorized admin consents. Then the cleanup runs, and Google releases the account.

How do you review the Google Ads change log after a hack safely?

1. Go through it line by line, not just the summary.
2. Compare it with your own records, your team and your agency.
3. Mark each change as yours or not yours before you open the form.
4. If some changes are yours, do not choose “Clean up”. Choose “Additional investigation” instead.

The first three steps are our advice. The last one follows Google’s description of the options.

Frequently Asked Questions

Who receives the Google Ads change log?

Google emails it to administrators who held their roles before the confirmed compromise date. The compromised user is excluded.

Can two administrators submit the decision?

No. Google says only one administrator can submit a decision.

Can I change my decision later?

No. Google says decisions cannot be changed once submitted.

Which option keeps me eligible for reimbursement?

Google says eligibility requires choosing “Clean up this account” or “Additional investigation is needed”.

What if I made my own changes during the incident?

Manual edits made while a decision is pending are erased after you submit. Pause your own changes until you have chosen.

Can you help me read the change log?

We can help you organize what to check. We cannot promise an outcome, because Google decides.