Signs Your Company Has Been Hacked and What to Do Next

Most cyber attacks do not announce themselves. Instead, attackers often sit quietly in a network, reading email and collecting passwords before they strike. Spotting the early signs your company has been hacked can turn a potential disaster into a contained, manageable incident.

In this guide, we cover the warning signs to watch for, where to check, and what to do in the first hour, day and week. We also explain who to contact in Australia and how to stop it happening again.

Why the signs your company has been hacked go unnoticed

Many breaches are found late, and often by someone outside the business. In most cases, that happens for three reasons.

First, nobody is watching the logs. Sign-in records, security alerts and email rules hold early clues, but they are easy to ignore when IT is busy. Second, attackers use legitimate tools and stolen passwords, so their activity looks like normal work. Finally, small oddities get explained away. A slow laptop or a strange login prompt seems minor until it is not.

Fortunately, the fix is simple in principle. Someone needs to watch for warning signs every day, and staff need to know how to report anything unusual.

Nine signs your company has been hacked

No single sign proves a breach. However, any of the following deserves a closer look, especially if two or more appear together.

Sign-in and email signs your company has been hacked

After all, stolen passwords are one of the most common ways in. Therefore, your sign-in and email records are the first place to look.

To begin with, watch for logins from unexpected countries or at unusual times. Similarly, a run of multi-factor authentication prompts that a staff member did not trigger often means someone already has their password. Likewise, new administrator accounts, or users suddenly given extra access, are another red flag.

Email also deserves special attention. Attackers who get into a mailbox often create hidden rules that forward messages elsewhere or delete replies. Next, they watch for invoices and send a convincing request to change payment details. As a result, a simple phone call to confirm any change of bank details, using a number you already have, prevents many losses.

Device, network and security tool warning signs

Meanwhile, compromised devices often feel different. For example, a laptop may slow down for no clear reason, show unfamiliar programs or reboot unexpectedly. Files that suddenly will not open, or have strange new extensions, can mean ransomware is already running.

On the network, by contrast, look for large uploads outside business hours or connections to unfamiliar services. This matters because attackers usually copy data out before they encrypt anything, so unusual outbound traffic is an important early clue.

Finally, treat any disabled security tool as urgent. Attackers often turn off antivirus, clear logs or delete backups just before launching ransomware. In fact, if backups have gone missing, assume an attack may be imminent. Of all the signs your company has been hacked, this one needs the fastest response.

Outside warnings you should never ignore

In some cases, the clearest signs your company has been hacked come from someone else. A customer might ask about an odd invoice from your domain, your bank might query a payment, or your IT provider might flag suspicious activity. For this reason, take every warning like this seriously and investigate before replying to the sender, in case their message is also part of the attack.

What to do if you think your company has been hacked

Above all, act quickly, but do not panic. The steps below help contain the damage while keeping the evidence you may need later.

Preserve evidence before you clean up

Of course, it is tempting to wipe an infected laptop and move on. However, doing so can destroy the evidence needed to work out what happened, what data was taken and whether you must notify anyone.

Instead, isolate the device and let specialists capture its state first. Our computer forensics team can preserve evidence, analyse what happened and provide a clear report for your insurer, lawyers or regulators. In addition, we offer rapid response when you need help fast.

How to stop it happening again

Finally, once the immediate threat is contained, close the gaps that let the attacker in. That way, you are far less likely to see the same signs your company has been hacked again.

A recognised baseline helps you prioritise. ASD Essentials, which the Australian Signals Directorate published in October 2026 to succeed the Essential Eight, builds on the same core controls listed below. In other words, working through them also moves you towards a standard that insurers and customers recognise. Our cyber security audits can show where you stand today.

The following controls block or expose most common attacks: