Most security advice focuses on keeping attackers out. That matters, but it leaves an uncomfortable question unanswered: what if someone is already in? Many compromises are quiet by design. An attacker who has stolen an email password or planted remote access software gains more by staying unnoticed, reading invoices, watching conversations and waiting for the right moment, than by announcing themselves.
This article covers five warning signs that a business may already be compromised, explains why each one matters, and sets out what to do in the first hour after you suspect something is wrong. The goal is not to make you paranoid about every slow laptop, but to help you recognise the patterns worth investigating and respond in a way that limits the damage.
Key takeaways
- Compromises often go unnoticed for months; small anomalies are worth taking seriously.
- Unexpected MFA prompts, password resets, new admin accounts and silent email forwarding rules are strong warning signs.
- Do not immediately power off and wipe affected machines; disconnect them from the network instead.
- Reset credentials from a clean device, and check email forwarding rules.
- A breach involving personal data may trigger Data Privacy Act notification duties within 72 hours.
1. Systems are slow, or sending traffic they should not
Computers slow down for many ordinary reasons. But unexplained, persistent slowness, especially across several machines at once, can indicate malware running in the background. Some malicious software uses your computers' processing power for its own purposes; other kinds quietly copy files out of the network.
The more telling sign is unusual outbound traffic, meaning data leaving your network. If your firewall or internet connection shows heavy uploads at odd hours, or connections to unfamiliar locations, that deserves a closer look. Large outbound transfers can indicate data being stolen before a ransomware attack, a pattern sometimes called double extortion.
2. Login activity nobody can explain
Your accounts often tell you when someone else is trying to use them, if you pay attention. Watch for:
- Account lockouts that the user did not cause, which can mean someone is guessing passwords.
- Multi-factor authentication (MFA) prompts the user did not trigger. MFA is the second step, such as an app notification or code, after a password. An unexpected prompt usually means someone already has the password. Some attackers send prompts repeatedly, hoping the user approves one just to make them stop.
- Password-reset emails nobody requested, which can mean someone is trying to take over an account.
- Sign-in alerts from unusual countries, devices or times of day.
Teach staff that an unexpected MFA prompt should be denied and reported, never approved.
3. Unknown devices or new admin accounts
Attackers who get in usually try to stay in. A common way to do that is to create their own account, often with administrator privileges, or to add a device they control to your network or cloud tenant.
Periodically review who has admin rights in your email platform, cloud services, firewall and accounting systems. Anyone you cannot identify, or any account created recently without a clear reason, should be investigated. The same goes for unfamiliar devices showing up on your network or registered to staff accounts.
4. Security tools turned off
Antivirus or endpoint protection software that has been disabled, uninstalled or excluded from scanning certain folders is a serious red flag. Users rarely do this on their own, and attackers often switch off defences before deploying ransomware or other tools.
Similarly, watch for backups that have stopped running, logging that has been disabled, or firewall rules that were changed without anyone recording why. Any change that reduces visibility or protection, made by someone you cannot identify, should be treated as suspicious until proven otherwise.
5. Email behaving strangely, or the worst case
Silent mailbox forwarding rules
One of the most common and damaging compromises in small businesses is a taken-over email account. Once inside, an attacker often creates a forwarding rule that quietly copies incoming mail to an outside address, or moves certain messages, such as those mentioning "invoice" or "payment", out of the inbox so the real owner never sees them. The attacker then uses what they learn to send convincing fake payment instructions to your clients or suppliers.
Check mailbox rules and forwarding settings on key accounts, especially finance, management and anyone who handles payments. Customers reporting odd emails "from you" is another warning sign.
Ransomware notes
The most obvious sign is a ransom note: files that will not open, renamed with strange extensions, and a message demanding payment. By the time this appears, the attacker has usually been in the network for some time. This is exactly when the first-hour steps below matter most.
What to do in the first hour
If you suspect a compromise, a calm, ordered response limits the damage and preserves your options.
- Do not immediately power off and wipe affected machines. Turning a machine off or reinstalling it can destroy evidence needed to understand what happened and how far it spread.
- Disconnect affected machines from the network instead: unplug the network cable and turn off Wi-Fi. This stops further spread while keeping the machine's state intact.
- Reset credentials from a clean device, one you have no reason to believe is affected. Resetting a password from a compromised machine may hand the new password straight to the attacker. Prioritise email, admin and financial accounts.
- Enable or check MFA on every critical account, and review which devices and sessions are currently signed in.
- Check email forwarding rules and remove anything you did not create.
- Notify your bank if financial accounts or payment processes may be affected, and warn key clients or suppliers if fake payment instructions may have been sent.
- Consider your Data Privacy Act obligations. Under NPC Circular 16-03, the National Privacy Commission and affected individuals must be notified within 72 hours of knowledge of a breach involving sensitive personal information, or information that could enable identity fraud, where it is likely to give rise to a real risk of serious harm. Confirm specifics with the NPC or a lawyer.
- Get qualified help. Incident investigation is specialist work. Write down what you have seen and done, with times, so whoever helps you can pick up quickly.
Where to start
You do not need to wait for an incident to act. This week, you can:
- Turn on MFA for email, cloud, banking and admin accounts.
- Review admin accounts and remove anyone who no longer needs access.
- Check forwarding rules on finance and management mailboxes.
- Confirm endpoint protection is running on every machine and backups are completing.
- Write down who to call and what to do, using the first-hour steps above, and share it with your managers.
If you want an independent check of how exposed you are today, Northgate's Security Baseline & Data Privacy Readiness assessment reviews your accounts, devices and settings and gives you prioritised, plain-language recommendations, including how to prepare for an incident. To discuss where you stand, book a free 30-minute call.