PanicStation.org
UK USA
uk Technology & digital loss cloud documents missing • cloud notes empty • notes disappeared after sign in • files missing after login • documents suddenly gone • cloud folder empty • drive looks blank • one drive empty after login • google drive empty after login • icloud drive empty after sign in • dropbox files missing • wrong account signed in • sync problem missing files • shared folder disappeared • deleted files in trash • restore previous version • account hacked files gone • signed in but nothing there • cloud storage looks wiped • online documents not showing

What to do if…
your cloud notes or documents suddenly appear empty after you sign in

Short answer

Pause and protect: stop making changes, take a quick record of what you’re seeing, and immediately confirm you’re in the correct account before anything can sync deletions everywhere.

Do not do these things

  • Don’t start “cleaning up” (moving folders, emptying Trash/Recently Deleted, or bulk-deleting) to “reset” things.
  • Don’t keep opening/saving/editing lots of files “to test” — you can overwrite good versions or reinforce a bad sync state.
  • Don’t uninstall/reinstall the app yet (or wipe a device) — you may lose a local cache that could help recovery.
  • Don’t share passwords or accept unexpected “support” calls/messages offering to “restore your files”.
  • Don’t assume it’s permanent — many “empty” incidents are wrong-account, view/filter, permissions, or sync-state problems.

What to do now

  1. Freeze the situation (reduce accidental sync damage).

    • On any device that shows “empty”, disconnect Wi-Fi (or use Airplane mode briefly).
    • Stop editing/creating notes/docs until you’ve checked the account and recovery areas.

  2. Capture proof and details (helps support).

    • Screenshot the empty view, the account email/username, and any error banners.
    • Note the time it started, device(s) affected, and whether you recently changed password, phone, or settings.

  3. Verify you’re in the right account (most common cause).

    • In the app/web, open account/profile and confirm the exact email/Apple Account/Microsoft account/Google account.
    • If the service supports multiple accounts or profiles, explicitly sign out and sign back in to the intended one (after you’ve taken screenshots).

  4. Check you’re looking in the right “place” (scope, filters, and sharing).

    • Clear any filters like Offline only / Starred / Shared / a specific workspace/team.
    • If it’s a work/school setup, check whether you’re in the right organisation/tenant or the right shared drive/team space.

  5. Check the built-in “not actually gone” areas.

    • Look for Trash / Bin / Recently Deleted and restore anything you recognise (do not empty these).
    • Check Recents, Activity, and Search (search a distinctive filename/phrase).

  6. Look for bulk change events (and signs of account takeover).

    • In the service’s security/activity history, look for unfamiliar sign-ins, new devices, or connected apps.
    • Note any mass deletions/moves/renames that happened around the time this started.

  7. Use built-in recovery tools (don’t improvise).

    • Use version history / restore / rewind features if offered (these are designed for “everything changed at once” scenarios).
    • If this is a work/school account, contact your IT/admin quickly — admins may have restore options you can’t access yourself.

  8. If you suspect compromise: recover the account first, then the files.

    • Follow your provider’s official account recovery steps.
    • After you regain control, change your password (unique) and turn on 2-step verification.
    • Sign out other sessions, remove unknown devices, and revoke unknown connected apps.

  9. Escalate with the provider and keep the case ID.

    • Use the provider’s support path and give: screenshots, time started, affected folders, and any suspicious activity details.
    • Ask specifically about account restore / file restore / previous versions / server-side recovery.

  10. If this happened via a scam/phishing attempt, report it (UK).

  • Forward suspicious emails to the UK phishing reporting address, and suspicious texts to the UK shortcode used for reporting spam/scam texts.
  • If you’ve been affected by fraud or cyber crime and live in England, Wales, or Northern Ireland, you can report via the national reporting service (Report Fraud/Action Fraud). If you live in Scotland (or the crime happened there), contact Police Scotland on 101. If a crime is happening now, call 999.

What can wait

  • You do not need to decide right now whether you’ll change providers, buy recovery software, or rebuild your whole notes system.
  • You do not need to organise files, rename folders, or “start over” until you’ve checked Trash/restore tools and account security.
  • You do not need to contact everyone you’ve ever shared with — first confirm whether it’s account scope/permissions vs deletion.

Important reassurance

This is common and often reversible. “Empty after sign-in” is frequently caused by being signed into the wrong account, a view/filter or permissions issue, or a recoverable deletion — not a true wipe. Slowing down now prevents making it worse.

Scope note

These are first steps to stabilise and protect recoverability. Later steps may involve deeper device checks, professional IT help, or a structured restore plan.

Important note

This is general information, not legal or professional advice. If you suspect an account takeover, prioritise regaining account control and preserving recoverable versions before making large changes.

Additional Resources
Support us