How to tell if your business has been hacked

Why hacks are often invisible

Attackers want to stay hidden for as long as possible, because time lets them find valuable data, set up payments fraud or prepare ransomware. Dramatic signs such as ransom notes appear only at the end. Before that, intruders use real accounts and normal tools, so nothing obviously breaks. Many small businesses find out from someone else: a client, a bank or a supplier. That means looking for small, unusual things rather than waiting for a crash. Most of the signs below can be checked in Microsoft 365 and on your computers by someone with admin access.

Email warning signs

Mailbox compromise is the most common hack in small offices. Watch for customers or suppliers asking about emails you did not send, replies to messages that are missing from your sent items, new inbox rules that move or delete messages, or forwarding to an outside address. Attackers often create a rule that hides replies containing words such as invoice or payment. In the Microsoft 365 admin and Entra ID portals, look at sign-in logs for logins from unusual countries or at strange times, and check the MFA methods registered to each user. A new authenticator app or phone number that the person did not add is a strong warning sign.

Computer and network warning signs

On computers, look for security software that has been disabled or reports being tampered with, unfamiliar remote access tools such as AnyDesk or ScreenConnect that you did not install, new local user accounts, scheduled tasks you do not recognise and unexplained slowdowns. Pop-ups asking for passwords, or browsers redirecting to strange sites, also warrant a closer look.

On the network, unusual outbound traffic at night, firewall logs showing connections to unfamiliar countries, new devices you cannot identify or backup jobs suddenly failing can all indicate an intruder. Attackers often target backups before launching ransomware. A sudden jump in data leaving the office, such as gigabytes uploaded overnight to an unfamiliar cloud storage service, may be the theft stage that comes before encryption.

Account and admin warning signs

New administrator accounts, existing accounts suddenly added to admin groups, or passwords changed without the owner knowing are serious signs. So are new applications granted access to your Microsoft 365 tenant, especially ones with broad permissions to read mail or files. Check enterprise applications and consent records in Entra ID. Outside your core systems, watch for changes to your website, domain DNS records, Google Business Profile or social media accounts, and for password reset emails nobody requested. These can signal a broader compromise.

Financial and outside signals

Unexpected payments, changed supplier bank details, missing funds or invoices that clients say they paid to a different account point to business email compromise. Bank fraud teams sometimes call about suspicious transactions. Treat those calls as genuine warnings, but verify by calling your bank on its published number. Your IT provider, the NCSC, a security researcher or a supplier may tell you they have seen your data, credentials or systems involved in an attack. Take that seriously even if everything looks normal from the inside.

What to do if you suspect a hack

Do not announce your suspicion by email, because the attacker may be reading it. Phone your IT provider or incident responder and agree a plan. Typical first steps include resetting passwords from a clean device, revoking sessions, removing unknown MFA methods and mailbox rules, and isolating suspicious computers from the network while leaving them on for investigation. Preserve evidence and keep notes of what you see and when. Report to the NCSC, notify your insurer if you have cyber cover, and start assessing whether personal information was involved for Privacy Act purposes. If money is involved, call the bank immediately.

Spotting problems earlier

Monitoring tools make many of these signs visible automatically. EDR alerts on suspicious behaviour on computers, Microsoft 365 can flag risky sign-ins and new forwarding rules, and backup systems can report unusual deletions. Someone needs to review those alerts promptly. A periodic security review, such as an Office IT health check, can also look for leftover accounts, unknown remote tools and risky settings before an attacker finds them.

Make it easy for staff to report anything odd, from a strange pop-up to a client query about an email. Early reports often come from ordinary people noticing something does not feel right. Thank people for raising concerns, even when they turn out to be harmless, so they keep doing it.