by Quick answer: Signs your business may have been hacked include unexpected password resets or MFA prompts, unfamiliar logins, forwarding rules you didn’t create, slow or failing systems, security tools switched off, unusual outbound traffic, and customers reporting odd emails from you. If you suspect it, isolate the affected accounts or devices, preserve evidence and call an incident response professional.
Warning signs on accounts and email
- Password reset or MFA approval requests you did not make
- Logins from unfamiliar locations or devices
- Email forwarding rules or inbox filters you did not set
- Sent messages you did not write, or customers receiving suspicious invoices
- New administrator accounts or changed permissions
Warning signs on devices and servers
- Antivirus or endpoint protection disabled or uninstalled
- Unusually slow performance, crashes or high CPU use
- Unknown programs, scheduled tasks or browser extensions
- Files renamed, locked or missing
- Remote access tools you did not install
Warning signs in the network and business
- Unexpected large outbound data transfers
- Traffic to unfamiliar countries or servers
- Unexplained bank, payroll or invoice changes
- Your data appearing on a leak site, or a ransom or extortion message
- A customer, vendor or the police telling you they’ve seen suspicious activity
What to do right now
- Don’t panic or delete things. Evidence matters.
- Change passwords from a clean device and revoke active sessions for affected accounts.
- Turn on or confirm MFA on email and admin accounts.
- Disconnect suspected devices from the network.
- Save logs and screenshots of anything unusual.
- Check email rules, forwarding and OAuth app permissions.
- Tell the right people internally, and call for help.
Who to call first
- Your IT or security provider, or an incident response firm if you have none.
- Your cyber insurer, if you have a policy; early notice is often required.
- Legal counsel, especially if personal, health or financial data may be involved.
- Your bank, if money or payment details are involved.
- Law enforcement, such as the FBI’s IC3 in the US.
How to find out for sure
Professionals check logs, endpoint telemetry, identity events and network data for indicators of compromise. A compromise assessment looks for evidence of past or ongoing intrusions. Because some attackers stay hidden for weeks, absence of obvious symptoms does not prove you are safe.
Common types of compromise and how they show up
| Type | Typical signs | First check |
|---|---|---|
| Email account takeover | Strange sent items, unknown forwarding rules, customers receiving fake invoices | Sign-in logs, mailbox rules, OAuth app grants |
| Business email compromise | Requests to change bank details, urgent payment demands, look-alike domains | Message headers and payment approval records |
| Malware or remote access trojan | Slow devices, unknown processes, security tools disabled | EDR alerts and startup items |
| Website compromise | Defaced pages, spam links, redirects, search engine warnings | File integrity, admin users, plugin versions |
| Credential stuffing | Many failed logins followed by a success, locked accounts | Authentication logs and rate limits |
| Ransomware precursor | New admin accounts, backup deletion, remote tools appearing | Privileged group changes and backup logs |
Where to look: quick checks you can do today
Microsoft 365 or Google Workspace
- Review recent sign-ins for unusual locations, impossible travel and legacy protocol use.
- Check mailbox rules and forwarding settings for each affected user.
- List third-party apps with access to mail and files and remove anything unfamiliar.
- Review recently created admin accounts and role changes.
- Check MFA registration changes and recently added devices.
Website and WordPress
- Look for unknown administrator users, unfamiliar plugins and recently modified files.
- Search your site on a search engine for spam pages or unexpected content.
- Check Google Search Console for security issues or manual actions.
Laptops and servers
- Run a full scan with up-to-date endpoint protection.
- List running processes, startup items, scheduled tasks and installed remote access tools.
- Check recent logins and newly created local accounts.
Network and cloud
- Look for new firewall rules, open ports or VPN accounts.
- Review cloud audit logs for new keys, roles and public storage changes.
- Check bandwidth reports for unexplained outbound spikes.
Mistakes that make things worse
- Reformatting machines before capturing evidence
- Changing passwords while the attacker is still in the mailbox or on the network
- Emailing about the incident from a compromised account
- Assuming that removing one piece of malware ends the incident
- Waiting to tell the insurer or your bank because you are unsure it is serious
What a professional investigation involves
- Scoping: understanding what is affected and what is at stake.
- Evidence collection: preserving logs, disk images and memory from key systems.
- Analysis: building a timeline from initial access to current activity.
- Containment: removing attacker access safely and in a coordinated way.
- Eradication and recovery: cleaning or rebuilding systems and resetting credentials.
- Reporting: findings for legal, regulatory and insurance purposes, plus hardening recommendations.
Hardening after a scare
Even if the review finds nothing, a suspected compromise is a good prompt to fix the basics. Enforce MFA for every user, block legacy authentication, review administrator accounts, patch internet-facing systems, turn on audit logging and consider 24/7 monitoring so unusual activity is investigated at once.
Why many intrusions go unnoticed for weeks
People often imagine that a hack is obvious, with a defaced website or a ransom note. In reality, most successful intruders try hard to stay quiet. After gaining a foothold they typically spend days or weeks looking around, finding the accounts and systems that matter and copying data before doing anything noisy. Business email compromise is deliberately subtle: the attacker reads real conversations, waits for a payment discussion and inserts one carefully timed message. Because nothing breaks, nobody investigates. This is why relying on “we would notice” is not a plan, and why logging and monitoring are so valuable. You cannot see what you do not record.
Small-business signals people overlook
- Slightly odd customer messages: clients mention an invoice or request you do not remember sending, or a supplier asks about a bank change you did not request.
- Sign-in alerts you dismissed: a “new device” or “unusual location” notification that was assumed to be a mistake.
- Security tool changes: an endpoint agent reporting offline, or a multi-factor setting that was changed.
- Unexpected software: new remote support tools, browser extensions or scripts on a few machines.
- Cloud bills and storage: a sudden jump in cost, new virtual machines or unfamiliar storage buckets.
- Mailbox behaviour: messages marked as read that you never opened, or emails missing from the inbox.
Any one of these might have an innocent explanation. Several together deserve prompt investigation.
Prevention beats detection
The same few measures reduce the likelihood that you will ever need to ask whether you have been hacked: strong multi-factor authentication everywhere, prompt patching of internet-facing systems, least-privilege access, endpoint detection and response, reliable and tested backups, and staff who know how and when to report something unusual. These are not exotic. They are basic hygiene that makes an attacker’s job much harder and the signs of their presence much easier to spot.
Key takeaways and a simple monthly check
You cannot rely on obvious symptoms to tell you that a compromise has happened, so build a routine of low-effort checks that make it more likely you will see the quiet signs. Once a month, someone should review administrator accounts and recent changes to them, mailbox forwarding rules for senior and finance staff, third-party applications with access to email and files, new sign-in locations for key accounts and the status of security tools on every device. Once a quarter, test that you can actually restore from backup and that alerts reach a person who will act on them. If something looks wrong, treat it as an incident first and a mystery second: contain, preserve evidence and ask for help early. The cost of a false alarm is small compared with the cost of an intruder with weeks of free access.
- Know who to call and have their numbers written down offline.
- Keep logs long enough to look back at least 90 days.
- Enforce MFA and remove legacy sign-in methods to close the easiest doors.
Frequently Asked Questions
Can I be hacked without knowing?
Yes. Attackers often stay quiet for days or weeks while they explore and steal data.
Is a pop-up virus warning a hack?
Not necessarily, but treat it seriously. Fake warnings are a common scam, and the real risk may be what you clicked or installed.
Should I change all passwords?
Start with email, admin and financial accounts, from a clean device. Do it after containing the problem so the attacker cannot capture the new ones.
How do I know if my email has been hacked?
Check sign-in history for unfamiliar locations or devices, look for forwarding rules you did not create, review sent items and see whether contacts report suspicious messages from you.
What should I do first if I think my business has been hacked?
Isolate affected devices or accounts, preserve evidence, change credentials from a clean device after containment and contact an incident response specialist and your insurer.
Should we report a suspected hack to the police?
Often yes, particularly if money was lost. In the US you can report to the FBI’s IC3. Reporting can also support insurance claims and recovery efforts.
Think something is wrong?
Our team investigates suspected compromises and monitors for threats around the clock. Explore our threat detection and response services →
