Signs Your Small Business May Have Been Hacked

Possible signs include unexplained account changes, emails your staff did not send, altered payment instructions, unexpected forwarding rules, and locked files accompanied by a ransom demand. Unusual device behavior can also deserve attention. Each signal needs context: your IT provider or administrator should check relevant records to determine whether someone gained unauthorized access.

An attempted attack and a successful intrusion require different conclusions. A failed login shows an attempt; it does not establish that someone entered the account. Likewise, an employee's computer may work normally while an attacker uses their online account from another device.

You do not need to establish every detail before reporting a serious concern. Start your business's incident response process as soon as you notice suspicious activity, especially when money, sensitive information, or essential systems may be affected.

• Contact your IT provider or responsible administrator. Use a known number or another trusted channel, particularly if your email may be compromised.
• Call your bank immediately if someone sent a fraudulent payment. Explain what happened and ask about stopping or recalling the transfer. Give the bank the transaction details you have.
• Use a separate, trusted device for sensitive communications when necessary. Avoid entering new passwords on a computer you suspect is infected.
• Ask qualified staff to contain the incident. They may need to isolate equipment or restrict account access, depending on what is affected.
• Preserve relevant records. Avoid deleting suspicious messages, wiping computers, or restoring backups over affected systems before responders assess the evidence.

The FTC's data breach response guidance emphasizes preserving evidence and involving appropriate experts. Do not routinely switch affected machines off without guidance; that action can remove information investigators need.

Your administrator also needs to consider online access. An attacker may still reach a cloud account after you disconnect a laptop. Keep your bank contact and technical response moving while someone records the facts already available.

You may notice signs of a cyberattack through everyday work before you understand the cause. Use the following situations to describe your concern clearly when you ask for help.

Why Are Employees Seeing Unfamiliar Sign-Ins or Account Changes?

An employee may report a sign-in they cannot explain, an unexpected password change, or a recovery address they never added. Ask when they noticed the change and whether anyone authorized it.

Your administrator can examine sign-in records to distinguish failed attempts from successful activity and identify the account and application involved. A successful sign-in still needs checking against the employee's work. You need enough context to distinguish legitimate access from unauthorized account access before describing the incident to others.

Why Are Customers Receiving Emails Your Team Did Not Send?

A customer may receive a strange payment request that appears to come from your business. Ask them to preserve the original message and avoid acting on its instructions while your team verifies it.

A criminal could be impersonating your address or sending through a compromised business email account. Your administrator can review delivery records to investigate the message's origin. Google Workspace's account investigation guidance includes email-log checks. Tell your customer how to reach your business through an established contact method while the investigation continues.

Why Have Email Forwarding Rules Changed?

Email rules automatically organize or redirect messages. An unfamiliar rule deserves attention when it forwards business mail to an unknown address or moves important replies out of view.

Microsoft explains that attackers can manipulate inbox rules to conceal activity or redirect messages. Your administrator should examine the rule and related account activity, then remove malicious settings as part of the response. Ask employees about authorized changes, too. A rule created for legitimate work needs different treatment from one nobody in your business approved.

Why Have Payment or Payroll Details Changed?

A vendor's new bank details or an unexplained payroll change deserves direct verification. Contact the person through details already in your records. Avoid using a new phone number supplied in the questionable request.

Business email compromise can involve impersonation or an accessed account. A fraudulent request alone cannot tell you whose systems were affected. Our guide to how to spot and prevent AI scams explains why convincing messages still need verification. Contact your financial institution immediately if money has already moved.

Why Are Files Locked or Accompanied by a Ransom Demand?

Files that suddenly become inaccessible alongside a payment demand can indicate ransomware. Report the problem immediately and ask your IT provider to assess the affected systems. Avoid opening more files simply to test how far the problem extends.

A browser warning alone does not establish that your files were encrypted. The FTC warns that fake security pop-ups can pressure people into calling scammers. Use your established support contact rather than a number displayed in the warning. Qualified staff can assess whether the alert reflects an actual infection.

Why Are Devices Behaving Differently?

A computer may become unusually slow, restart unexpectedly, or open unfamiliar programs. The UK National Cyber Security Centre lists these behaviors among possible signs of infection.

Ordinary software or hardware problems can also interrupt work, so describe the change without assuming its cause. Tell your IT provider what you were doing when it began and whether other employees noticed similar problems. Those details help them decide what to investigate. Avoid installing unfamiliar cleanup software because an advertisement claims it can fix the issue.

Why Have Account Permissions or Connected Apps Changed?

An unfamiliar administrator role or connected application may give someone access your business never intended. Ask the person responsible for the service to compare the change with approved work.

Microsoft's compromised-account guidance directs administrators to review application permissions, administrative roles, and authentication methods. An unfamiliar name alone does not explain who approved the access or what it allows. Your administrator needs to establish those details and address unauthorized access. Tell them about recent software installations or outside contractors who may have requested legitimate permissions.

What if a Customer or Provider Reports Suspicious Activity?

An outside report may give you information your own team has not seen. Ask what the person observed, when it happened, and which account or transaction was involved. Record the details without asking them to send unnecessary sensitive information.

Verify anyone who claims to represent your bank, software provider, or technical support company. Contact the organization through its official app or an established number. A caller's claim that your business was hacked does not prove it. Do not grant remote access or disclose login codes to an unexpected caller.

You can use this map to assign the next check and explain your concern. Each row identifies a starting point; your provider may need to examine several related systems.

Avoid counting symptoms to decide whether your business is safe. One confirmed unauthorized change can justify urgent action, while several slow computers may share an ordinary technical problem. Your response should reflect the evidence and possible impact.

Your knowledge of daily operations helps a responder interpret unusual account activity. You may know that an employee was on leave, a vendor changed contacts, or your team installed software that morning. Share those facts and separate them from assumptions.

Prepare a short record with the information you already have:

• Time and time zone: Note when someone first noticed the problem and when the suspicious activity reportedly occurred.
• Affected accounts or devices: Identify the employee, service, or computer involved.
• Original communications: Preserve relevant emails, invoices, and transaction references through approved channels.
• Visible details: Record alert wording or capture a screenshot when safe.
• Actions already taken: Note password changes, calls, disconnections, or other steps, along with who performed them.

Your provider may examine logs, which are records of events within an account or system. Available details depend on the service and its settings. Ask the provider what records they need and how you should share them securely. Keep passwords and sensitive customer information out of public forums or AI chats. Our guide to AI for small businesses explains the privacy and security risks to review before your team uses these tools.

The signs your business has been hacked can help focus an investigation, but the responder still needs to establish what access occurred and what information may have been affected.

Seek qualified help promptly when you suspect an administrator account was accessed, files were encrypted, money was diverted, or sensitive information was exposed. You should also ask for help when nobody in your business can interpret the relevant records.

Start with your existing IT provider and ask whether they can investigate the incident or need a specialist. Explain which services your business depends on and which problems are interrupting work. You can then agree on responsibilities and a reliable contact for updates.

A small business data breach may also require legal advice about notifications. Applicable obligations depend on the information involved and the relevant laws or contracts. Contact your cyber insurer if you have coverage and review its incident-reporting requirements.

After responders address the incident, use the small business cybersecurity guide to review prevention measures with your team. Keep that work separate from any urgent investigation still underway.

You can respond more clearly to signs your business has been hacked when your team knows whom to contact and what information to preserve. Explore American Wired for practical coverage that helps you understand cybersecurity and make informed technology decisions for your business.

Written by

American Wired Editorial Team

writter

The American Wired Editorial Team delivers trusted coverage of technology, business, AI, and innovation with a commitment to accuracy, insight, and relevance.