10 Signs Your Business Has Been Hacked

Very few businesses find out they've been hacked from a dramatic on-screen ransom note. Far more often, the compromise announces itself quietly — a password reset email nobody requested, a customer replying "did you really send me this invoice?", a login from a city the account owner has never visited — and it's dismissed as a glitch, a fluke, or somebody else's mistake until the pattern becomes impossible to ignore. By the time that happens, an attacker may have already had days or weeks of unnoticed access, which is exactly the gap this guide is meant to close.

This matters because detection speed is one of the single biggest factors in how much a security incident ends up costing a business. Our ransomware deep-dive and our guide on business email compromise both cover specific attack types in detail; this guide takes a different angle — it's a practical, plain-language list of the warning signs that apply across many kinds of compromise, both the technical signs a system might show and the behavioral signs that show up in how people, customers, and money start behaving strangely.

This guide walks through why detection is often slower than business owners assume, the ten specific signs to watch for (a mix of technical and behavioral), a comparison table to help gauge urgency, exactly what to do in the first hour if you suspect a compromise, three real Canadian case studies, a response checklist, honest CAD cost ranges for investigation and recovery, and Canadian government resources for reporting and further guidance.

Why Businesses Often Don't Realize They've Been Hacked Right Away

It's tempting to assume a hack would be obvious — screens locking up, files disappearing, some dramatic on-screen announcement. That's true for one specific category of attack, ransomware, which is designed to announce itself loudly because the attacker needs the victim to know in order to pay. Most other forms of compromise are the opposite: designed specifically to stay quiet for as long as possible, because a longer undetected presence gives the attacker more time to explore the network, escalate privileges, steal credentials, and extract value before anyone notices.

Several structural reasons make this detection gap worse for small and medium businesses specifically. Most SMBs don't have a dedicated security team watching logs around the clock — someone has to notice something looks wrong during the normal course of their day, which means subtle signs get missed far more easily than they would with active monitoring in place. Attackers who gain access through stolen, legitimate-looking credentials (rather than obviously malicious malware) can often move through a network without tripping traditional antivirus at all, since from the system's perspective it just looks like a normal login. And perhaps most importantly, individual warning signs in isolation are genuinely ambiguous — one unexpected password reset email could just be a mistyped email address from someone else entirely, one customer complaint about a strange invoice could be a one-off scam unrelated to your systems. The signal only becomes clear once you know to look for the pattern across several signs at once, which is exactly the gap this guide is built to close.

Why Non-Technical Staff Often Notice First

One counterintuitive pattern worth understanding: in a meaningful share of real compromises, the person who first notices something wrong isn't in IT at all. It's the receptionist who thinks it's odd that a client called about an email nobody remembers sending. It's the bookkeeper who notices an invoice total looks slightly off from what was quoted. It's the sales rep who gets a text from a long-time client asking "hey, is this really from you?" about a message that looked suspicious.

This matters for two practical reasons. First, it means security awareness can't be treated as an IT-only concern — every employee who interacts with customers, vendors, email, or financial systems is a potential first line of detection, whether or not they have any technical background at all. Second, and more importantly, it means the business needs a genuinely easy, low-friction way for any employee to flag something that feels off without worrying they'll be seen as overreacting or wasting IT's time. A workplace culture where raising a concern is met with "good catch, let's check it out" rather than "it's probably nothing" catches real compromises meaningfully earlier than one where employees quietly talk themselves out of speaking up.

Practically, this means the reporting process should require nothing more sophisticated than "tell your manager or call IT support" — not a formal ticket system, not a multi-step form, nothing that adds friction between noticing something and reporting it. The businesses in our case studies below that caught a compromise early did so specifically because someone felt comfortable raising a concern immediately rather than waiting to see if it happened again.

The 10 Signs Your Business May Have Been Hacked

The list below deliberately mixes technical signs (things a system shows) with behavioral signs (things people notice), because a real compromise often produces both at once — and because behavioral signs are frequently noticed first by non-technical staff who wouldn't recognize a technical indicator even if they saw it.

1. Password reset or MFA prompts you didn't trigger

An email confirming a password change, or a multi-factor authentication push notification asking you to approve a login, when nobody on your team actually requested it, is one of the clearest and earliest signs an attacker already has your username and is trying to gain full control or is testing whether your credentials still work. This sign is frequently dismissed as "probably spam" or "must have been a misclick" — it deserves the opposite reaction: treat every unrequested MFA prompt as a real attempt in progress until proven otherwise, and never approve one you didn't initiate.

2. Unusual login locations or times in account activity logs

Most major platforms — Microsoft 365, Google Workspace, banking portals, accounting software — keep a login history showing location and time. A login from a country your business has no connection to, or a login at 3am local time when nobody on staff works overnight, is a strong technical indicator worth investigating immediately rather than assuming it's a VPN quirk or a mislabeled location.

3. Files renamed with strange extensions, or a ransom note appears

This is the unmistakable, dramatic sign most people picture when they think "hacked" — file names ending in unfamiliar extensions, folders suddenly full of text files with instructions for payment, or a full-screen message announcing your data has been encrypted. If this happens, it means ransomware has already executed; the priority shifts immediately from investigation to containment, covered in the next section.

4. Unexplained spike in outbound network or email traffic

A sudden, unexplained increase in data leaving your network, or a mail server suddenly sending a large volume of outbound messages, often indicates either data exfiltration (an attacker copying data out) or your systems being used to send spam or phishing emails to others without your knowledge. This is a technical sign best caught by network monitoring tools or an IT provider watching bandwidth and mail server logs, since it's rarely visible from a normal user's day-to-day view of their computer.

5. Customers or vendors report receiving strange emails "from you"

This is one of the most common ways a business first learns it's compromised — not from its own systems, but from an outside party. A customer calling to ask "did you really send an invoice with new banking details?" or a vendor reporting a strange attachment "from your account" is a strong behavioral sign that your email account or domain has been compromised or spoofed, and should trigger immediate password resets and MFA review even before a full investigation is complete.

6. New, unrecognized admin or user accounts

Attackers who gain administrative access frequently create a new account for themselves as a way to maintain access even if the originally compromised account gets its password reset. A periodic review of user and, especially, administrator accounts across your email platform, network, and key business software that turns up an account nobody remembers creating is a serious technical sign requiring immediate investigation.

7. Antivirus or security software disabled without anyone doing it intentionally

Many attackers, once they gain sufficient access, deliberately disable or tamper with antivirus and endpoint protection specifically to avoid detection while they carry out further actions. Security software that shows as disabled, out of date, or "not running" on a device where nobody recalls turning it off is a strong technical indicator of active compromise, not routine software drift.

8. Noticeably slower systems, unexpected pop-ups, or browser redirects

While often caused by mundane issues (too many browser tabs, an outdated machine, a legitimate but poorly optimized program), a sudden and unexplained slowdown combined with unexpected pop-ups, new browser toolbars nobody installed, or a browser homepage that keeps changing back after being reset can indicate malware running in the background. This sign is genuinely ambiguous on its own and worth weighing against the rest of the list rather than assumed to always mean compromise — but it shouldn't be dismissed either, especially in combination with any of the other signs here.

9. Missing, altered, or unexplained financial records and transactions

Invoices that don't match what was actually sent, banking details that changed without a documented approval process, or transactions nobody on the finance team recalls authorizing are a serious behavioral and financial sign, frequently associated with business email compromise or direct account takeover of financial systems. Because the financial impact compounds with every day the issue goes unnoticed, this sign deserves same-day escalation, not a "we'll look into it next week" response.

10. Employees report being locked out of accounts they should have access to

An employee suddenly unable to log into email, a shared drive, or business software they use daily — with no IT-initiated password change to explain it — can mean an attacker has changed the password after taking over the account. This is easy to initially chalk up to "IT must have done a routine update" or "probably just a glitch," but should be verified immediately with whoever manages accounts rather than assumed to be benign, particularly if more than one employee reports it around the same time.

Sign	Type	Typical Urgency	First Action
Unrequested password reset / MFA prompt	Technical	High	Deny the prompt, reset password from a clean device, review login history
Unusual login location/time	Technical	High	Review full login history, force sign-out of all sessions, reset password
Ransom note / renamed files	Technical	Critical — act now	Disconnect device from network, do not shut down, call IT immediately
Outbound traffic spike	Technical	High	Have IT/network provider investigate mail server and bandwidth logs
Customer reports strange email "from you"	Behavioral	Critical — act now	Reset email password + MFA immediately, notify all recent contacts
Unrecognized admin/user account	Technical	Critical — act now	Disable the account, force password resets, review admin activity logs
Security software disabled unexpectedly	Technical	High	Isolate device, re-enable if possible, have IT investigate why it was disabled
Slowdowns / pop-ups / redirects	Technical	Medium	Run a full scan, weigh against other signs, monitor closely
Unexplained financial transactions	Behavioral	Critical — act now	Freeze/verify with bank immediately, review recent approvals, call IT and insurer
Employees locked out unexpectedly	Behavioral	High	Verify with account admin immediately, reset affected accounts, review logs

Read plainly, the table points to a useful rule of thumb: any single sign involving money, a ransom note, or an external report from a customer or vendor deserves same-hour escalation, while signs like general slowness deserve attention but not necessarily panic on their own. The real value, though, comes from recognizing when multiple signs from this list show up together in a short window — that combination is a much stronger signal than any one item alone.

Tools That Catch These Signs Automatically

Everything covered so far assumes a person notices something and reports it — a genuinely valuable habit, but an incomplete strategy on its own, since some of the signs on this list (like a spike in outbound network traffic or a subtle new admin account) are difficult for a non-technical employee to notice at all without the right tooling in place. A few categories of tooling exist specifically to close this gap.

Endpoint detection and response (EDR) software monitors behaviour on individual devices — not just matching known malware signatures the way traditional antivirus does, but watching for suspicious patterns of activity (a program suddenly trying to access files it's never touched before, an unusual process spawning from a document, a login attempting privilege escalation) and flagging or blocking them automatically. Our EDR vs antivirus guide covers this distinction in more depth. Network monitoring tools watch traffic patterns across the business as a whole, catching the kind of unusual outbound data movement covered in sign four above, which is essentially invisible from any single user's perspective. Dark web credential monitoring services check whether your business's email addresses and passwords have appeared in a known data breach dump elsewhere on the internet, giving you a warning before a reused, compromised password gets used against your own systems.

None of these tools replace the human awareness this guide is built around — a monitoring tool can miss context a person would catch (like a customer mentioning something odd, or an invoice total that just looks wrong), and a person will always notice things no automated tool is watching for. The strongest posture combines both: staff who know what to watch for and feel comfortable reporting it, plus tooling that catches the signs no person could reasonably be expected to see on their own.

What to Do in the First Hour If You Suspect a Hack

A closely related mistake worth naming separately: treating the first hour as the finish line rather than the starting point. Isolating a device, resetting a password, and calling IT support stops the immediate bleeding, but it doesn't answer the harder question of scope — what else, if anything, did the attacker touch before being noticed? Businesses that stop at the first-hour steps and never follow up with a proper investigation sometimes discover months later that the same attacker retained access to a different account or system the initial response never checked, precisely because nobody confirmed the full extent of what happened before declaring the incident closed.

Real-World Scenarios: Recognizing the Signs (or Missing Them)

The following are composite scenarios based on patterns IT Cares technicians have encountered across Canadian small business clients, anonymized and combined rather than describing any single identifiable client.

Case study 1: The marketing agency that ignored a password reset email (Ottawa, ON)

A 12-person marketing agency in Ottawa had an employee receive a password reset confirmation email for a shared project management account, assumed it was a phishing attempt or a fluke, and deleted it without mentioning it to anyone. Three weeks later, a client called asking about an unusual invoice with new banking details that had gone out under the agency's name. By the time the agency traced it back, the attacker had been quietly reading internal project communications for over three weeks, and the fraudulent invoice attempt very nearly succeeded — the client caught it only because the requested amount was unusually large. Total direct cost of the incident, including the investigation and account remediation, ran to roughly $7,200 CAD; had the client not called to verify, the attempted fraud itself targeted a further $34,000 CAD payment that was ultimately stopped in time.

Case study 2: The dental clinic that caught it fast (Sherbrooke, QC)

A dental clinic in Sherbrooke had an employee notice an MFA approval prompt appear on her phone at 11pm, well outside clinic hours, and — having read about exactly this warning sign in a previous staff security briefing — immediately denied it and called the office manager rather than dismissing it. The clinic's IT provider was engaged within the hour, confirmed a credential-stuffing attempt using a password reused from an unrelated external breach, forced a reset across all clinic accounts, and enabled MFA on remaining accounts that lacked it. Because the sign was recognized and acted on immediately, the clinic's total incident cost was under $1,500 CAD in IT investigation time, with no data actually accessed by the attacker.

Case study 3: The wholesale distributor with a quiet six-week compromise (Winnipeg, MB)

A wholesale distributor in Winnipeg experienced a slow, quiet compromise that went unnoticed for roughly six weeks — a combination of an unrecognized admin account created early on, gradually slower system performance staff attributed to "old computers," and a modest but real spike in outbound email traffic nobody was actively monitoring. The compromise was ultimately discovered when a long-time vendor mentioned receiving several odd, slightly-off-brand emails from the distributor's domain over the preceding month. A full investigation revealed the attacker had exfiltrated a portion of the customer contact database before being detected. Total cost of investigation, remediation, mandatory privacy breach notification to affected customers under PIPEDA, and reputational cleanup came to approximately $58,000 CAD — a cost the business's leadership directly attributed, in the post-incident review, to three separate warning signs each having been individually dismissed rather than connected.

Business Hack Response Checklist

Use this checklist to gauge how prepared your business actually is to recognize and respond to a compromise, not how prepared you assume you are:

• ☐ Staff have been briefed on the specific warning signs in this guide, not just told to "be careful online"
• ☐ Multi-factor authentication is enabled on email, banking, and admin accounts
• ☐ There's a clear, known process for reporting something suspicious immediately, not "figure it out yourself first"
• ☐ Login/account activity logs are reviewed periodically, not only checked after a problem is already suspected
• ☐ Someone (internal or an IT provider) is responsible for monitoring for unusual network or email traffic
• ☐ Admin account lists are reviewed periodically for unrecognized entries
• ☐ We have a documented first-hour response plan (isolate, don't shut down, reset passwords, call IT)
• ☐ We know our cyber insurance policy's incident notification requirements and timeline, if we carry one
• ☐ We have a named IT provider or security contact we can reach quickly, with contact info stored somewhere accessible if systems are down
• ☐ Financial approval processes require verification outside of email for banking detail changes
• ☐ We understand our notification obligations under PIPEDA if personal data may be involved

If more than three or four of these are unchecked, that's a clear, specific starting point rather than a reason for alarm — most businesses have MFA on some accounts and a vague sense that "IT handles that," but few have an actual documented first-hour plan or a staff briefing on the specific signs covered in this guide.

Cost Reality Check for Canadian SMBs

The cost of a suspected or confirmed hack varies dramatically depending on how early it's caught and how far it spread before detection — which is, again, the central argument for knowing the warning signs. Here's how it typically breaks down:

• Caught early (single account, no confirmed data loss): A straightforward investigation, password reset, and account remediation by a managed IT provider often runs $300–$1,500 CAD in professional time, particularly when caught within hours of the first warning sign.
• Caught mid-stage (some lateral movement, limited exposure confirmed): Investigation, broader remediation across multiple accounts or systems, and a closer look at what was accessed typically runs $2,000–$10,000 CAD.
• Caught late (extended dwell time, confirmed data exfiltration or financial fraud): Full forensic investigation, legal counsel, mandatory breach notification to affected individuals, and reputational remediation can run from the low tens of thousands of CAD well into six figures for larger incidents, particularly where regulated data or a large customer base is involved.

These are directional ranges to help with planning, not a guaranteed quote — actual cost depends heavily on how many systems were touched, what data was involved, and how quickly the business responded once signs appeared. The pattern holds across every incident IT Cares has responded to: early recognition of the signs in this guide is, consistently, the single biggest lever a business has over how much a compromise ends up costing. Our cyber insurance guide covers how a policy can absorb a meaningful share of these costs when one is in place before an incident occurs.

It's worth being explicit about the return on investment implied by these numbers: a modest, recurring monthly spend on monitoring tooling or a managed security service is, in almost every case IT Cares has reviewed, dramatically cheaper than even the low end of the "caught late" cost tier above. A business spending nothing on detection isn't actually saving money if the eventual cost of a late-caught compromise is ten or twenty times what a year of reasonable monitoring would have cost — it's simply deferring and multiplying the expense, with the added downside that the deferred version also includes downtime, reputational damage, and possible regulatory exposure that a monitoring subscription's price tag never had to account for in the first place.

Canadian Resources for Reporting and Guidance

Several Canadian government and institutional bodies publish free resources relevant to recognizing, reporting, and responding to a suspected business compromise:

• BDC (Business Development Bank of Canada, bdc.ca): Publishes practical cybersecurity and risk-awareness resources aimed specifically at Canadian small and medium businesses as part of its broader business advisory content.
• ISED (Innovation, Science and Economic Development Canada, ised-isde.canada.ca): Canada's federal department for business innovation and growth publishes small business cybersecurity guidance, including material on recognizing common attack patterns.
• OPC (Office of the Privacy Commissioner of Canada, priv.gc.ca): If a compromise involves personal information, PIPEDA requires notifying the OPC and affected individuals where the breach creates a real risk of significant harm; the OPC publishes detailed guidance on these obligations.

Beyond these bodies, businesses should also consider reporting cybercrime to the Canadian Anti-Fraud Centre and, for serious incidents involving significant financial loss or data theft, local police — and should consult legal counsel to confirm the specific notification obligations that apply to their province and industry.

For Quebec businesses specifically, Law 25 imposes its own breach notification requirements to the Commission d'accès à l'information (CAI), running in parallel to federal PIPEDA obligations and, in some respects, with stricter timelines and requirements than the federal framework alone. A business operating in Quebec that confirms a compromise involving personal information should treat both frameworks as potentially applicable rather than assuming compliance with one automatically satisfies the other, and should involve legal counsel familiar with both regimes early in the response process rather than after notification decisions have already been made.

Frequently Asked Questions