Cybersecurity · What to do now
How Do I Know If My Business Has Been Hacked?
The most common signs your business has been hacked are things that don't add up: emails you didn't send, sign-in alerts or password resets nobody asked for, files that won't open or have strange names, security software that was turned off, and unexpected payment or bank changes. One sign alone doesn't prove an attack, but several together, or anything involving money or encrypted files, should be treated as an incident right away.
By SupportMax · Updated October 13, 2026
Do this first
1
Don't turn off or wipe affected computers
2
Disconnect them from the network
3
Get help from someone who handles incidents
SupportMax: 310.331.8119 · Mon–Fri, 9–6 Pacific.
Plain-English guidance
Based in West Los Angeles
Calm, step-by-step help
One accountable team
Video · 30 seconds
Read the transcript
Emails you didn’t send. Password resets nobody asked for. Files that won’t open. Those are common signs of a hack, along with disabled security software or unexpected payment changes. One sign alone doesn’t prove an attack. But several together, or anything involving money or encrypted files, should be treated as an incident. Don’t wipe affected computers. Disconnect them from the network. Call SupportMax. Emergency help is available after hours.
Warning signs
Signs your business has been hacked
Look for these, especially more than one at a time.
01
Strange email activity
Messages you didn't send, replies to emails you never wrote, or new forwarding rules.
02
Unexpected sign-ins
Login alerts, MFA prompts, or password resets nobody started.
03
Files you can't open
Renamed or encrypted files, or a message demanding payment.
04
Money that moves
Changed bank details, unexpected payments, or invoices you don't recognize.
The first hour
What to do if you think you've been hacked
Stay calm and work through these in order.
Get Clarity on What's Going On1. Contain it
Disconnect affected computers from the network, but don't turn them off or wipe them. Evidence on them helps with recovery.
2. Secure accounts
From a computer you trust, change passwords for email and financial accounts and check for unknown rules or sign-ins.
3. Get help and report it
Call your IT provider or incident response help. Report the incident to the FBI's IC3 and contact your bank if money is involved.
Where to look
Signs in accounts, devices, and money
Check each area.
Accounts and email
Who is signing in
Sign-ins from unusual places
Forwarding rules nobody set up
Contacts receiving odd emails from you
Locked accounts or changed passwords
Computers and network
What devices are doing
Security software turned off
New programs or remote tools
Encrypted or renamed files
Unusual network activity
Money and data
What leaves the business
Changed payment instructions
Unexpected transfers
Customers told their data was exposed
Your passwords found online
CISA's #StopRansomware guide includes a response checklist, CISA explains how to report a cyber incident, and the FBI's Internet Crime Complaint Center (IC3) takes reports of cybercrime and fraud.
Avoid making it worse
What not to do
Don't wipe or reinstall computers before someone has looked at them, don't pay a ransom without advice, and don't keep using an account you think is compromised. Don't email your team about the attack from an account that may be hacked. If an employee clicked something suspicious, see what to do after a phishing click.
Incident response →How SupportMax helps
How SupportMax helps if you've been hacked
01
Contain
We help isolate affected computers and accounts and stop the spread.
02
Secure
We reset passwords, remove attacker access, and check for hidden rules and tools.
03
Recover
We help restore systems and data from backups and get your team working again.
04
Prevent
We close the gaps that let it happen, with monitoring, MFA, and training.
Working with SupportMax
One accountable team, clear next steps
Think you've been hacked?
Call 310.331.8119, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We'll help you understand what happened and what to do first, in plain English.
Questions
Signs of a hack: common questions
Have a question that isn't here? Call 310.331.8119 or schedule a free consultation.
Is one strange email a sign we were hacked?
Not on its own. But emails you didn't send, plus sign-in alerts or new forwarding rules, are strong warning signs.
Should we turn off the infected computer?
Disconnect it from the network instead. Turning it off or wiping it can destroy information that helps with recovery.
Who should we report a hack to?
Report cybercrime to the FBI's IC3, contact your bank if money is involved, and check your insurance policy. Your legal advisor can tell you about other notifications.
Should we pay a ransom?
Talk to incident response help, law enforcement, and your insurer before deciding. Paying doesn't guarantee you get your data back.
How do we know it is over?
When attacker access has been removed, passwords changed, systems checked and restored, and the gap that let them in has been closed.
Can SupportMax help right now?
Call 310.331.8119 during business hours, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. See our incident response help.
Worried your business has been hacked?
Call 310.331.8119, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We'll help you contain it, secure your accounts, and recover, in plain English.
Prefer to call? 310.331.8119 · Mon–Fri, 9–6