Warning signs
How to tell if your business has been compromised
The clearest signs your business has been hacked are sign-ins or MFA prompts nobody recognizes, email rules or messages nobody created, security tools turned off, encrypted or missing files, and unexplained changes to payment details. If you see any of them, call ACS Cyber’s 24/7 incident line at 1-650-300-7557 before you change or delete anything. We help you confirm what is happening and contain it.
01
Sign-ins or MFA prompts nobody recognizes
Sign-in alerts from unfamiliar places or devices, or MFA prompts that nobody requested. Someone may have a password and be trying to use it.
02
Email rules or messages nobody created
New inbox rules, forwarding to an outside address, or sent messages nobody wrote. Attackers use these to watch a mailbox and hide replies.
03
Security tools off or new admin accounts
Endpoint protection disabled, alerts silenced or administrator accounts nobody set up. These are common steps before a larger attack.
04
Files encrypted, renamed or missing
Files with strange extensions that will not open, missing folders, deleted backups or a ransom note. This may be ransomware.
05
Changed payment details or odd emails from you
New bank details on an invoice, unexpected payment requests, or customers asking about strange emails that appear to come from you.
- Password resets nobody requested
- Account lockouts nobody caused
- Bounce-backs for mail you did not send
- Unfamiliar remote-access tools
- Unusual uploads or data transfers
- Backups failing or deleted
Not a client yet? You can still call. If you are unsure whether what you see is a real problem, call and talk it through with us.
Warning signs by area
What to look for, area by area
Some signs are obvious. Many are quiet. These are observable signs worth checking, grouped by where they show up. One sign on its own does not prove a compromise, but it does deserve a closer look.
Email in Microsoft 365 and Google Workspace
An attacker who reaches a mailbox often stays quiet and watches.
- Inbox rules that move, delete or mark messages as read
- Forwarding to an outside address nobody set up
- Sent or deleted messages nobody recognizes
- Replies about emails you never sent
- Bounce-backs for mail you did not send
Accounts and sign-ins
Identity is often the first thing an attacker takes.
- Sign-ins from unfamiliar locations or devices, or at odd hours
- MFA prompts or codes nobody requested
- MFA methods or phone numbers nobody added
- Password resets or lockouts nobody caused
- Apps with access to mail or files that nobody approved
Computers and servers
Attackers often change devices to keep their access and avoid being seen.
- Endpoint protection turned off or uninstalled
- Remote-access software nobody installed
- Unfamiliar programs, services or scheduled tasks
- Security logs cleared or alerts silenced
- Slowdowns or heavy activity with no clear cause
Network and remote access
The way in is often a remote-access path that is open to the internet.
- VPN or remote desktop sign-ins from new places or at odd hours
- Firewall rules or open ports nobody approved
- Unknown devices on the network
- Connections to unfamiliar systems outside business hours
- Large or unusual uploads to unfamiliar destinations
Money and payments
Payment fraud often starts with a compromised or impersonated mailbox.
- Vendors asking to change bank details by email
- Payments a vendor says it never received
- Urgent payment or gift-card requests from an executive
- Payroll or direct-deposit changes the employee did not request
- Bank alerts about transfers nobody approved
Data and extortion
Data theft and ransomware can leave signs in files, backups and your inbox.
- Files that will not open or have new extensions
- A ransom note on screens or in folders
- Backups failing, changed or deleted
- Files shared outside the organization that nobody meant to share
- A message or call claiming someone has your data
Reading the signs
What a sign may mean, and what to do
A sign is a reason to look closer, not proof. Here is what common signs can point to and the safest next step. When in doubt, call before you change anything.
| Sign | What it may mean | What to do |
|---|---|---|
| An MFA prompt nobody started | Someone has a password and is trying to sign in | Deny it, never approve it, and call. We will help you reset the password safely and check for other access. |
| A sign-in from a place or device nobody recognizes | A stolen password or session in use, though travel or a VPN can also explain it | Note the time and location and call, so the password reset and sign-out of all sessions happen in a planned order, from a trusted device. |
| An inbox rule or forwarding address nobody created | Someone is watching the mailbox or hiding replies, often ahead of payment fraud | Do not delete it. Take a screenshot and call. The rule is evidence of what the attacker wanted. |
| A new administrator account, or a user nobody approved | Someone may have high-level access and a way back in | Do not delete it. Record the account name and call, so it is disabled as part of planned containment. |
| Security tools turned off or uninstalled | A step attackers often take before ransomware or data theft | Treat it as urgent and call the 24/7 incident line now. |
| Remote-access software nobody installed | An attacker may have set up their own way in | Do not uninstall it. Call. We may advise disconnecting the device from the network and leaving it powered on. |
| Files with new extensions, or a ransom note | Ransomware may be encrypting files | Disconnect affected devices from the network without powering them off, keep the note and call now. See ransomware response. |
| Changed bank details or an unexpected payment request | Business Email Compromise, at your organization or a vendor’s | Do not pay. Verify by phone using a number you already have. If money has moved, call your bank first, then us. See BEC and wire fraud. |
| Customers asking about odd emails from you | A compromised mailbox, or someone impersonating your domain | Do not reply in the thread. Warn contacts by phone and call us. Sent items, message headers and sign-in records can help show which it is. |
This is general guidance. If our team, your IT provider or your insurer advises differently, follow their direction.
If you find something, stop. Do not delete rules, accounts or files, and do not reply to or alert the sender. Cleaning up can destroy evidence and warn the attacker. Note what you saw and when, then call our 24/7 incident line at 1-650-300-7557 before you clean anything up. If money has already moved, also call your bank’s fraud department right away.
Self-check
A self-check you can run today
You do not need special tools to start. Ask your IT team, IT provider or Microsoft 365 or Google Workspace administrator to work through these checks, starting with the accounts of owners, executives, finance staff and administrators. Work from a trusted device. If a check turns up something nobody can explain, record it and call before changing anything.
01
Review recent sign-ins
Look at recent sign-in activity for key accounts. Flag sign-ins from unfamiliar countries, devices or apps, at odd hours, or from two distant places close together. How far back the records go depends on your subscription.
02
Check inbox rules and forwarding
On key mailboxes, list every inbox rule (filters, in Gmail) and any forwarding to outside addresses. Look closely at rules that delete, move or mark messages as read, or that match words like invoice, payment or wire.
03
Review registered MFA methods
For each account, check which phones, authenticator apps and security keys are registered. Every method should belong to the person and be one they recognize.
04
Review admin roles and new accounts
List who holds administrator roles in Microsoft 365, Google Workspace, Azure or AWS and on your servers, and look for recently created user accounts. Each should have a known owner and a reason to exist.
05
Review third-party app access
Check which apps have been granted access to mail, files or calendars. An unfamiliar app with broad permissions can keep an attacker’s access alive after a password reset.
06
Confirm security tools are running everywhere
Make sure endpoint protection is installed, running and reporting on every computer and server, including rarely used ones. Look for remote-access software nobody approved.
07
Confirm backups, including a protected copy
Check that backups are completing, that restores have been tested, and that at least one copy is offline or immutable, so it cannot be changed or deleted from the network.
08
Confirm recent payment-detail changes
Ask finance to list recent changes to vendor bank details and payroll direct deposits, and confirm each by phone using a number you already had on file, not one from the email.
Did a check turn something up?
Stop there and call our 24/7 incident line at 1-650-300-7557. We will help you work out what it means and contain it while preserving the evidence. Not a client? You can still call.
Forensic investigation
When a self-check is not enough
A self-check covers the most common signs. A careful attacker may leave few of them. If you have a specific concern, such as an unexplained alert, a suspicious payment request or one of the signs above, an investigation by our in-house forensic team can give you a clearer answer.
Our in-house forensic team looks for evidence of attacker activity across your endpoints, servers, identities, email, firewall and cloud logs, including Microsoft 365, Google Workspace, Azure and AWS. We confirm a compromise or report that we found no evidence of one, as far as the available records allow, and document the findings for your leadership, insurer and counsel.
To keep watch after that, our 24/7 managed detection and response service has our in-house SOC analysts monitoring your environment around the clock, with human-led investigation and pre-approved containment under rules agreed with you in advance.
- Endpoints and servers: unfamiliar tools, new accounts and ways back in
- Identities: risky sign-ins, new MFA methods, admin roles and app access
- Email: rules, forwarding, delegates and unusual sending
- Network and firewall: unusual connections and data transfers
- Plain-language findings, with the evidence behind them
When to call right away
Call 1-650-300-7557, day or night, if you see any of these. You do not need to be a client.
- A ransom note, or files that suddenly will not open
- Security tools turned off on several devices
- Administrator accounts nobody created
- Money sent to changed bank details
- Someone claiming to have your data
- Accounts or settings changing while you watch
Not sure what you are seeing?
Not every odd alert is an attack, and not every attack is obvious. Book a free 30-minute consultation to talk it through with our team. We will help you decide whether it needs a closer look and what a sensible next step would be. If something is happening right now, call 1-650-300-7557 instead.
Next steps
Found something? Go to the right guide
Each guide covers first steps for a specific situation, what to avoid and how we help.
What to do if you think you are compromised
A step-by-step guide to the first actions: who to call, what to isolate, what to leave alone and what to have ready.
Ransomware
Files are encrypted, systems will not start or a ransom note has appeared.
Business Email Compromise and wire fraud
Bank details were changed, a fraudulent invoice was paid or a trusted mailbox sent payment requests.
Phishing and hacked Microsoft 365 accounts
Someone clicked a link or approved an MFA prompt, and an email account is behaving oddly.
Data breach or exposure
Customer, patient, employee or financial records may have been accessed, copied or shared.
Finding out what happened
How our in-house forensic team works out how attackers got in, what they did and whether they are still there.
Prevention
Keep it from happening again
The signs on this page are easier to catch early, and less damaging, when someone is watching and the common ways in are closed. If you are recovering from an incident, see recovery and protection after an incident.
24/7 managed detection and response
Our in-house SOC analysts monitor endpoints, Microsoft 365, Google Workspace, Azure, AWS, firewalls and servers around the clock, investigate what they find and take pre-approved containment actions under rules agreed with you. ACS supplies and manages the EDR agent.
Security awareness training
Phishing simulations and short, practical lessons help your people recognize the signs on this page and report them.
Vulnerability management and penetration testing
Regular scanning, prioritized patching and in-house penetration testing help close the weaknesses attackers look for, such as exposed remote access.
vCISO and incident-response planning
A security roadmap, a written incident-response plan and tabletop exercises, so your team knows what to do when a warning sign appears.
FAQ
Questions about the signs of a compromise
Look for sign-ins or MFA prompts nobody recognizes, email rules or forwarding nobody created, security tools that have been turned off, new administrator accounts, files that are encrypted or missing, and changed payment details. One sign is not proof, but it is a reason to look closer.
If you see any of these, call ACS Cyber’s 24/7 incident line at 1-650-300-7557 before you change or delete anything.
Common signs include sign-ins from unfamiliar locations or devices, MFA prompts you did not request, MFA methods you did not add, new inbox rules or forwarding, unfamiliar apps with access to your mailbox, and contacts receiving emails you did not send.
An administrator can look for confirmation in the account’s sign-in and audit logs. See our guide to hacked email and Microsoft 365 accounts.
It usually means someone has your password and is trying to sign in. Deny the prompt, never approve it, and tell your IT team or call us. The password should then be reset from a trusted device, and the account checked for other access, such as new MFA methods or inbox rules.
Ask your Microsoft 365 or Google Workspace administrator to list the inbox rules and forwarding settings on each key mailbox, starting with owners, executives and finance staff, and to check organization-wide mail flow or routing rules too. Look for rules that delete, move or mark messages as read, rules that match words like invoice or payment, and forwarding to outside addresses.
If you find one nobody created, do not delete it. Record it and call, because it shows what the attacker was after.
Yes. Attackers often try to stay quiet: they use real accounts and legitimate remote-access tools, and may spend time collecting passwords or copying data before they do anything visible, such as encrypting files.
That is why monitoring matters. With 24/7 managed detection and response, our in-house SOC analysts watch for that quieter activity around the clock and investigate what they find.
A compromise assessment is a focused investigation that looks for evidence that an attacker is in, or has been in, your environment. When you have a specific concern but no clear incident, our in-house forensic team can investigate it: we review endpoints, servers, identities, email, firewall and cloud logs, and report what we found and what to do next.
No investigation can prove that nothing ever happened; it shows what the available evidence supports.
Often, yes, though they can be subtle. Signs that can come before encryption include new administrator accounts, security tools being turned off, remote-access tools appearing on computers or servers, unusual sign-ins to servers or VPN, backups being changed or deleted, and large or unusual data transfers out of the network.
If you see any of these, treat it as urgent and call the 24/7 incident line. See ransomware response.
Your IT team or IT provider can run the basic checks on this page, and an incident response team with forensic investigators can take a closer look at the evidence.
ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. Headquartered in San Jose, California, we support organizations nationwide, and our in-house forensic team investigates suspected and confirmed incidents. Our 24/7 incident line, 1-650-300-7557, is open to organizations that are not yet clients.
Pause before you change anything: do not delete rules, accounts or files, and do not alert the sender. Note what you saw and when, then call ACS Cyber’s 24/7 incident line at 1-650-300-7557, even if you are not a client. If money has already moved, also call your bank’s fraud department right away.
Our step-by-step guide for a suspected compromise covers what comes next.
24/7 incident line
Seeing one of these signs right now?
Call 1-650-300-7557 before you change or delete anything, and speak with our incident team. Not a client? You can still call. If nothing is urgent and you want a second opinion, book a free 30-minute consultation. For other situations, see how we help after any compromise.