Cyberattacks rarely begin with a dramatic red screen announcing, “Congratulations, you’ve been hacked.”
Real compromises are usually less theatrical.
Maybe an employee gets an MFA prompt at 2:17 a.m. Someone notices an email in their Sent folder that they swear they did not send. A vendor calls about a strange invoice. Your server suddenly gets busy when everyone has gone home. A new administrator account appears that nobody remembers creating.
Each of these could have an innocent explanation.
They can also be the digital equivalent of finding a muddy footprint in your kitchen.
The uncomfortable reality is that a compromised business can continue operating normally while an attacker quietly explores its systems, steals credentials, accesses email, copies files, or establishes another way back in. That makes knowing the early warning signs just as important as having tools intended to prevent the intrusion in the first place.
And the threat continues to evolve. Verizon’s 2026 Data Breach Investigations Report says exploitation of software vulnerabilities has now overtaken stolen credentials as the leading way attackers initially enter compromised environments. The report nevertheless emphasizes the enduring importance of cybersecurity fundamentals. [verizon.com], [verizon.com]
So, how do you know whether your business has actually been compromised?
Let’s look for the footprints.
What Does “Compromised” Actually Mean?
A compromise does not necessarily mean ransomware is encrypting every computer in the office.
Think of cybersecurity like protecting a building. An attacker does not have to burn down the building to constitute a security incident. If someone steals a key, enters after hours, photographs confidential documents, and leaves without anyone noticing, you still have a serious problem.
The same principle applies digitally.
A business may be compromised when an unauthorized person gains access to an account, computer, server, cloud service, application, or data. The attacker might steal information immediately, but they might also maintain access and wait.
That distinction is important because businesses sometimes look exclusively for obvious malware while overlooking suspicious identity and account activity.
Microsoft’s 2025 Digital Defense Report illustrates the scale of the identity problem. It says identity-based attacks increased 32 percent during the first half of 2025, and more than 97 percent were large-scale password attacks. [news.microsoft.com]
The bad guy may not need to “hack” your computer in the Hollywood sense.
Sometimes he simply logs in.
Sign #1: Employees Are Getting Login or MFA Prompts They Did Not Initiate
An employee is making coffee when their phone buzzes.
“Approve sign-in?”
They aren’t signing in.
They tap Deny and get back to work.
That should not be the end of the story.
An unexpected multifactor authentication request can indicate that someone is attempting to authenticate as that employee. Unexpected password-reset messages and unfamiliar sign-in notifications deserve similar scrutiny.
MFA remains an enormously important defense. CISA describes multifactor authentication as a layered approach in which users provide two or more credentials, helping protect an account even when one credential has been compromised. [cisa.gov]
But suspicious MFA activity itself can be evidence worth investigating.
If an employee receives an authentication request they did not initiate, don’t simply tell them to reject it. Determine what caused it. Review sign-in activity, check the source and location when available, change affected credentials when warranted, and investigate whether anything else about the account has changed.
A denied MFA prompt might be the security control doing exactly what you paid for it to do.
It might also be the moment you discover someone already has the password.
Sign #2: Email Starts Behaving Strangely
Business email is especially attractive because it contains conversations, relationships, documents, calendars, invoices, and information about how money moves through the company.
Warning signs can be surprisingly mundane.
An employee may discover messages they did not send. Customers might receive suspicious emails that appear to come from a legitimate company account. Messages may unexpectedly disappear, or legitimate correspondence may start showing up somewhere other than expected.
Don’t stop at changing a password.
If an account may have been compromised, investigate how it was accessed and what happened afterward. Review recent authentication history, account permissions, active sessions, forwarding behavior, mailbox rules, and other configuration changes supported by your email platform.
Imagine an attacker compromises the mailbox of someone who routinely deals with vendors. They do not need to immediately send 10,000 spam messages and announce their presence. Quietly observing legitimate conversations may be far more useful.
That is why strange email behavior deserves attention even if the rest of the computer seems perfectly normal.
Sign #3: New Accounts, New Administrators, or Permission Changes Appear
Here’s a wonderfully boring security question:
Who has administrator access?
It becomes much more exciting when nobody knows the answer.
Unexplained administrator accounts, newly elevated permissions, unexpected changes to MFA settings, unfamiliar remote-access configurations, and users gaining access to resources outside their normal responsibilities can all justify investigation.
These changes matter because the account an attacker initially compromises may not be the account they ultimately want.
A standard user’s credentials might only provide access to email. An administrator can potentially provide access to substantially more. Attackers may therefore attempt to expand their privileges or establish additional ways to maintain access.
This is one reason periodically reviewing privileged accounts is useful even when nothing appears wrong.
If “temp-admin-2” has been sitting in the directory for six months and nobody can explain what it does, today’s security review just got more interesting.
Sign #4: Your Computers or Network Are Doing Things Nobody Can Explain
Sometimes the evidence appears at the device or network level.
A machine might suddenly communicate with unfamiliar systems, execute unexpected processes, or generate substantially different traffic than its normal baseline. Security software might become disabled. Remote-access tools might appear unexpectedly. Employees may experience strange browser behavior or find software they did not install.
None of those observations alone proves malicious activity.
Context matters.
A new application might have been installed by IT. A traffic spike might be a legitimate backup. A remote-management program may belong to your support provider.
The question is whether the activity is expected and explainable.
Recent ransomware investigations show why unexplained legitimate tools deserve attention too. An updated 2026 joint advisory from the FBI, CISA, and the U.S. Department of Health and Human Services documents Medusa ransomware actors using a broad collection of techniques and tools for network discovery, persistence, stealth, and command-and-control activity. [ic3.gov]
In other words, malicious activity does not always arrive conveniently labeled definitely-a-virus.exe.
Sign #5: Security Tools Start Complaining
Security alerts are a little like smoke detectors.
Occasionally one complains about burnt toast. You still don’t solve that problem by taking the batteries out.
Repeated endpoint protection alerts, blocked authentication attempts, detections involving suspicious scripts, repeated account lockouts, or unusual sign-ins should be investigated in context.
One isolated alert might be benign. Several alerts involving the same user or computer can tell a much more interesting story.
This is where centralized monitoring and useful logging become valuable. Individually, a strange login, endpoint alert, and unfamiliar cloud session may seem inconclusive. Put them on the same timeline and you may discover they are connected.
Logs are not glamorous.
Neither are seat belts.
Sign #6: Files Are Changed, Deleted, Encrypted, or Suddenly Inaccessible
Ransomware is among the least subtle signs of a compromise, particularly once encryption begins.
Files may acquire unfamiliar extensions. Shared folders can become inaccessible. Systems might display ransom notes. Backups may be damaged or unavailable.
But focusing only on encryption can miss what happened earlier.
The current ransomware model often includes data theft as well as encryption. The August 2026 government advisory on Medusa, for example, describes a double-extortion model in which attackers encrypt data and threaten to publicly release stolen information if payment is not made. [ic3.gov]
That changes the incident-response question.
It isn’t simply:
“Can we restore the files?”
It is also:
“What information could the attacker have accessed or removed?”
A successful restore can recover operations. It does not magically pull copied information back from someone else’s hands.
Sign #7: Customers, Vendors, or Employees Notice Before You Do
One of the most uncomfortable breach notifications can come from outside your organization.
“Did you mean to send this?”
“Why did your payment instructions change?”
“Your account sent me a strange link.”
“We’re getting messages from your domain.”
Take reports like these seriously.
A third party may see something your internal tools did not immediately recognize.
Your vendor relationships also deserve attention because compromise does not necessarily begin within your own technology. Verizon’s 2026 DBIR highlights third-party involvement as an increasingly important part of the breach landscape. [verizon.com], [verizon.com]
Security boundaries are rarely as neat as the network diagram suggests.
Sign #8: Your Website or Cloud Services Change Without Authorization
Your public website suddenly redirects visitors somewhere strange.
A cloud administrator finds an unfamiliar application registration.
DNS settings change.
A security feature gets turned off.
A new integration appears.
These changes warrant investigation because modern businesses depend on far more than office computers. Email, websites, cloud applications, identity providers, file-sharing platforms, remote-access services, and third-party SaaS systems can all become meaningful parts of an attack path.
And software itself increasingly represents an important entry point. The 2026 Verizon DBIR reports that vulnerability exploitation became the most common initial access vector in its dataset, overtaking stolen credentials. [verizon.com], [verizon.com]
That makes unexplained changes to internet-facing systems particularly worthy of attention.
“Nothing Looks Wrong” Is Not the Same as “Nothing Is Wrong”
This may be the most important point in this article.
A quiet network isn’t proof of a clean network.
Many useful actions for an attacker are relatively quiet. An account can be accessed without crashing a computer. Information can be viewed without deleting it. Credentials can be stolen while the employee continues working normally.
That is why mature security programs do not rely exclusively on users noticing something strange. They collect logs, monitor identities and endpoints, review alerts, patch vulnerabilities, restrict privileged access, and maintain backups because prevention alone cannot answer the question:
“If someone got in yesterday, would we know?”
That is the real test.
What Should You Do If You Suspect a Compromise?
The first priority is to avoid accidentally destroying useful evidence or making the situation worse.
Don’t start randomly deleting files, wiping computers, or disabling services without understanding what is happening. Incident response should be deliberate.
Start by documenting what was observed, including affected users, systems, alerts, timestamps, screenshots, and unusual behavior. Preserve relevant logs and evidence. If necessary, isolate affected systems in a manner appropriate to the incident and involve qualified security or incident-response professionals.
For accounts suspected of compromise, simply changing the password may not address every form of access. Existing sessions, tokens, application permissions, forwarding configurations, authentication settings, and other persistence mechanisms may also require review.
If ransomware is suspected, CISA recommends practices including remediation of known exploited vulnerabilities, MFA for services such as webmail and VPN access, and network segmentation to limit ransomware spread. [cisa.gov]
Reporting obligations can also depend on what happened, what information was involved, your industry, contracts, insurance requirements, and applicable law. Treat those decisions as incident-specific and involve the appropriate legal, regulatory, insurance, and cybersecurity professionals.
The Question Every Business Should Be Able to Answer
There is a big difference between:
“We haven’t noticed a breach.”
and:
“We have enough visibility to determine whether we’ve been breached.”
The second statement requires more than antivirus software.
It requires knowing what normal activity looks like, having logs available when something goes wrong, protecting identities, keeping systems patched, controlling administrator access, monitoring endpoints, maintaining reliable backups, and having a response process before an emergency occurs.
Those fundamentals remain important even as attack techniques change. Microsoft reports processing more than 100 trillion security signals each day and analyzing approximately 38 million identity-risk detections daily, which gives some perspective on the sheer volume defenders face. [microsoft.com]
You cannot eliminate every suspicious event.
You can become much better at recognizing the ones that matter.
How Ethixa Solutions Can Help
For many small and midsize businesses, the hardest part is not buying another security product. It is connecting the dots between identity, endpoints, servers, cloud services, backups, vulnerabilities, and the alerts those systems create.
An MSP such as Ethixa Solutions can help organizations evaluate those layers, identify gaps in visibility and protection, manage and monitor relevant systems, and develop a practical response plan for suspicious activity.
The goal should not be to promise that an attack can never occur.
A better goal is to make your organization harder to compromise, improve the likelihood that suspicious activity is detected, and make sure everyone knows what to do when something doesn’t look right.
Because eventually, someone will notice a muddy footprint.
The important question is what happens next.
Leave a Reply