7 Signs Your Business May Be Under a Cyberattack Right Now

Most cyberattacks don't announce themselves. There's no dramatic countdown on your screen — just a handful of small, easy-to-dismiss oddities that, taken together, usually mean something is seriously wrong. By the time most business owners notice something's off, an attacker may have already had access for days or weeks. Here are seven real warning signs worth taking seriously.

1. Password reset emails you didn't request

An email saying "your password was reset" or "a new device signed in" that you didn't trigger is one of the clearest early signs someone else has your credentials. Don't ignore these as spam — verify them.

2. Files that won't open, are renamed, or have a strange new extension

This is the classic sign of ransomware. If files suddenly have extensions you don't recognize, or you find a text file demanding payment to unlock your data, disconnect the affected computer from your network immediately and call for help.

3. Computers running unusually slow, crashing, or overheating

Malware running in the background — especially cryptomining malware, which uses your hardware to generate cryptocurrency for an attacker — can make a computer sluggish, loud, or hot even when you're not doing anything demanding.

4. Colleagues or clients ask about strange emails "from you"

If people you know start receiving phishing emails, invoices, or password-reset links that appear to come from your business email, your account (or someone else's in your organization) has likely been compromised and is being used to attack your contacts.

5. New programs, browser toolbars, or pop-ups you didn't install

Unfamiliar software appearing on a work computer, browser homepages changing on their own, or a sudden flood of pop-up ads are all common symptoms of malware that snuck in through a bad download or malicious email attachment.

6. You're locked out of accounts you normally have access to

If your password suddenly stops working and you didn't change it, an attacker may have already changed it for you — a common move to lock the real owner out while they operate inside your systems.

7. Unexplained spikes in your cloud, hosting, or IT bill

A sudden, unexplained jump in your Azure, AWS, or Microsoft 365 usage costs can mean an attacker is using your cloud resources for their own purposes, sending mass spam through your email service, or exfiltrating large amounts of data.

What to do if you notice these signs

• Don't panic, but don't wait either. The faster you respond, the less damage occurs.
• Disconnect affected devices from your network (unplug ethernet, turn off Wi-Fi) if you can do so safely, but don't power them off completely — that can destroy evidence needed to understand what happened.
• Don't pay any ransom demand before talking to a professional. Payment doesn't guarantee your data comes back, and there are often better options.
• Call for help immediately rather than trying to troubleshoot it yourself. Time matters more than almost anything else in the first hours of an incident.

Most of these signs are easy to dismiss individually — a slow computer, one weird email, a password that didn't work the first time. The businesses that catch attacks early are the ones who take a second look instead of shrugging it off. If something feels off, trust that instinct and reach out.