Twelve signs you've been hacked

Most businesses find a breach long after it starts. Dwell time, the gap between break-in and discovery, is often weeks and sometimes months. Meanwhile attackers steal data, dig in, move through the network and prepare ransomware.

Spotting the signs early shortens that time. Here are twelve, what each means and what to do.

1. Unusual account activity

You see logins from strange places or devices, and password resets you did not ask for. New admin accounts appear, or MFA is off.

Stolen credentials are the most common way in. Once inside, attackers add admin accounts or change MFA so a new password does not lock them out.

• Reset the account’s password.
• Turn MFA back on, and check no attacker device is registered.
• Review the account’s mail rules, sent mail and file access.
• Look for new accounts or permission changes.
• Review 30 days of sign-in logs for every account.

2. Sudden slowness

Fast computers turn sluggish, the network slows, apps time out and saving takes longer.

Hidden malware uses processor, memory and bandwidth, and cryptomining malware uses a lot. Stolen data leaving the network also slows it. Slowness alone proves nothing, but a sudden drop across several systems needs a look.

• Check Task Manager or Activity Monitor for strange, heavy processes.
• Look for unusual traffic, especially large uploads.
• Run an endpoint detection scan.
• If several systems slow at once, look for rogue devices or traffic.

3. Software you did not install

New programs, browser extensions or toolbars appear. New services start at boot, or the browser’s homepage, search engine or bookmarks change.

Attackers install tools to stay in, record keystrokes, redirect traffic or stage the next attack. Rogue extensions steal credentials and browsing data. Remote access tools posing as normal software give lasting access.

• Record the software’s name and location with a screenshot.
• Do not just uninstall it, which destroys evidence.
• Take the machine off the network if you suspect an active attack.
• Have a security professional analyse it first.
• Check every other system for the same software.

4. Ransom notes or encrypted files

Files gain odd extensions such as .encrypted or .locked. The wallpaper becomes a ransom note, payment notes appear in folders, and documents will not open.

By the time you see the note, encryption is done. Modern ransomware steals data first and threatens to publish it, even if you restore from backup.

• Disconnect affected systems at once.
• Do not pay without expert advice, since payment guarantees nothing and funds more attacks.
• Identify the ransomware strain if you can, since it shapes recovery.
• Check your backups are intact before restoring.
• Report it to the FBI at ic3.gov.
• Call a professional incident response team.

5. Email sent without you

Contacts get strange emails from you. Your sent folder holds messages you did not write, and bounces or auto-replies arrive for mail you never sent.

A hijacked mailbox is among the most dangerous breaches. Attackers phish your contacts, who trust your address, and redirect payments through business email compromise. They also read everything in the mailbox.

• Change the password from a device you know is clean.
• Look for rules that forward mail outside, a very common trick.
• Review sent, deleted and other folders for the attacker’s mail.
• Warn your contacts.
• Turn on or recheck MFA.
• Revoke any OAuth tokens for apps you did not approve.

6. Browser redirects and pop-ups

Searches go to strange sites, pop-ups appear with the browser closed, and links or new tabs open the wrong pages.

It may be adware. It may also be changed DNS settings, malware inside the browser or a rogue extension. If DNS changed on the network, every device is affected.

• Check DNS settings on the device and on the router or firewall.
• Remove unknown browser extensions.
• Clear the cache and reset the browser.
• Run a full scan with up-to-date endpoint protection.
• If several devices are hit, check the network’s DNS and firewall for changes.

7. Security tools switched off

Endpoint protection shows as off and will not turn back on. Windows Defender is disabled, firewall rules have changed or update services are stopped.

Serious malware switches off security tools early. If you did not do it, treat it as a confirmed breach until proved otherwise.

• Do not just turn the tools back on, since the malware will switch them off again.
• Disconnect the system.
• Scan it from a clean recovery environment.
• Expect to need professional incident response.
• Check other systems for the same signs.

8. Unexplained data changes

Records change with no audit trail, and files are opened at odd hours, such as 3 AM on a Saturday. Large exports happen without approval, or settings change without a ticket.

Changing or stealing data is often the point of the breach. Attackers cover their tracks, take data to sell or extort, and export in bulk. You may need monitoring tools to see it.

• Save logs and audit trails before they are overwritten.
• Pin down which records, which times and which accounts.
• Work out whether the changes used stolen logins or another way in.
• Check outbound traffic logs for stolen data.
• Call your cybersecurity team or an incident response firm.

9. Unusual outbound traffic

Firewall logs show large uploads to unknown addresses or links to known bad domains. Bandwidth runs high, often out of hours.

This is one of the most reliable signs of an active breach. Malware calls its command-and-control servers, sends out stolen data and downloads more tools, often at night.

• Find which systems send the traffic.
• Block the destinations at the firewall, though this may alert the attacker.
• Capture traffic for forensic analysis.
• Isolate the source systems.
• Check DNS logs for suspicious or newly registered domains.

10. Locked out of your own accounts

Your usual logins fail for email, cloud or internal systems. Reset emails never arrive because the recovery address changed. Admin access is gone, or the domain registrar login fails.

This is often the attack’s endgame, giving the attacker sole control. With your registrar or DNS provider, they can redirect your whole online presence. Treat it as an emergency.

• Call each provider by phone, since email may be compromised.
• Prove your identity and ownership to regain access.
• If the registrar is compromised, contact its abuse team and ICANN.
• Change every credential from a clean device on a clean network.
• Get professional help immediately.

11. Strange processes and services

Process lists show unknown names, and unknown services start on their own. Scheduled tasks appear that IT did not create, and PowerShell windows flash open and shut.

Persistent malware installs itself as a service, task or startup item to survive reboots. Fileless malware runs in memory through tools such as PowerShell, which antivirus misses. Unknown processes with system rights strongly suggest a breach.

• Record each process’s name, file location and account.
• Do not end the processes yet, which destroys evidence and alerts the attacker.
• Check file hashes on VirusTotal, a free service.
• Review scheduled tasks and startup items.
• Have a security professional analyse it before you act.

12. Complaints from customers or partners

Customers get suspicious emails or invoices from you, and partners find malware in your shared links. Clients see unauthorised transactions, or your website redirects to bad sites.

Here the breach reaches you from outside, after customers are already hurt. It also means attackers have been in long enough to turn your systems on the people who trust you.

• Investigate at once, even if you have seen nothing inside.
• Tell affected customers and partners honestly and specifically.
• Ask a lawyer about notice duties, since many states have breach notification laws.
• Investigate every system the attackers may have reached.
• Prepare a public statement if the scope calls for it.

When you suspect a breach

In the first hour

1. Contain. Isolate affected systems, but leave them on to keep evidence in memory.
2. Record. Note times, systems, signs and every action taken.
3. Escalate. Tell IT, management and your security provider.
4. Preserve. Delete and clean up nothing, since the evidence shows scope and prevents a repeat.

In the first 24 to 72 hours

1. Size it. Count the systems, accounts and data affected.
2. Bring in experts. Without in-house security skills, hire an incident response team now.
3. Notify. Tell your lawyer, your cyber insurer and affected staff.
4. Start fixing. Only once you know the scope and how the attacker got in.

Over one to four weeks

1. Finish the fix. Remove all attacker access, close the way in and reset any exposed credentials.
2. Meet legal duties. Notify affected people, regulators and police as required.
3. Review. Record what happened, how, what failed and what will change.
4. Strengthen. Make the changes the review names.

When to call a professional

Call at once for any of these.

• Signs of ransomware.
• Lockout from admin accounts.
• Security tools switched off.
• Data stolen.
• Customers or partners affected.
• Several signs at once.

SBK’s cybersecurity practice handles incident response, assessments and monitoring in the NYC area. A quick check costs far less than a breach left running for weeks.

Questions people ask

How do attackers usually get in?

Most get in through stolen credentials, unpatched software or social engineering. Credentials come from phishing or breach databases sold on the dark web. Phishing email is the single most common way in, so email security and staff training come first.

How long until a breach is found?

Studies put the median at 10 to 21 days where some monitoring exists. Without monitoring, it can take months. EDR, network monitoring and log analysis cut that time sharply.

Should we pay a ransom?

Decide with your lawyer, your cyber insurer and an incident response team. Paying guarantees nothing, may fund more crime and can create legal problems. Usually it is better to restore from backup and prevent a repeat.

Only one computer seems affected. Is that fine?

No. One machine may be the visible part of a larger breach. Isolate it, investigate and check other systems, since many breaches spread from one device.

How do we avoid being hacked?

Use MFA on every account, EDR instead of plain antivirus, and prompt patching. Add email security with phishing protection, staff training, tested offsite backups and monitoring. Most breaches exploit missing basics, not rare zero-day flaws.