5 Signs You’ve Been Breached – And What to Do Next

A cyber breach isn’t always obvious. While some attacks trigger immediate disruption, others can go unnoticed for weeks or even months, giving attackers time to access sensitive data, compromise accounts and move deeper into your network.

For businesses, recognising the warning signs early can make a significant difference to the impact of an incident. Unusual account activity, unexpected system changes or unexplained network traffic could all indicate that something isn’t right.

The challenge is knowing what to look for, and what to do if you suspect your organisation has been compromised.

Here are five warning signs to watch for, and the steps you can take to respond.

1. Unusual login activity or compromised accounts

Unexpected login attempts, sign-ins from unfamiliar locations or activity outside normal working hours can indicate that someone is attempting to access your systems without authorisation.

Attackers may use stolen credentials, phishing emails or brute-force attacks to gain access to legitimate accounts. Once inside, they can be difficult to distinguish from genuine users, particularly if multi-factor authentication (MFA) is not consistently enforced.

What to do next:

• Review authentication logs for unfamiliar locations, devices, IP addresses and unusual login patterns.
• Investigate unexpected MFA requests, password resets and changes to account permissions.
• Secure affected accounts by revoking active sessions, resetting credentials and reviewing MFA settings.
• Check for additional accounts that may have been compromised or created without authorisation.

Don’t assume that changing a password alone will resolve the issue. If an attacker has established persistence or compromised other accounts, further investigation will be needed.

2. Unexpected system behaviour or performance issues

Slow-running systems, unexplained crashes, unusual CPU or memory usage and unfamiliar processes can sometimes indicate malicious activity.

Malware may run in the background, while attackers could be using compromised devices to scan the network, establish remote access or prepare for a wider attack.

However, performance issues are not automatically evidence of a breach. Hardware faults, software updates and legitimate workloads can cause similar symptoms.

What to do next:

• Check endpoint detection and response (EDR) alerts and system logs for suspicious processes or applications.
• Investigate unexpected software installations, configuration changes and unfamiliar remote access tools.
• Identify whether the issue affects one device or multiple systems across the network.
• If a device appears compromised, follow your incident response procedures to isolate it safely without destroying evidence.

The aim is to establish whether the behaviour is a routine technical issue or part of a wider security incident.

3. Suspicious network traffic or connections

A compromised device may communicate with external servers controlled by attackers, transfer sensitive information or attempt to spread across the internal network.

Unusual outbound connections, unexpected data transfers, communication with unfamiliar domains and unexplained spikes in network activity can all warrant investigation.

These indicators can be particularly important when attackers are trying to remain undetected rather than immediately disrupt business operations.

What to do next:

• Review firewall, network detection and security monitoring logs for unusual connections and traffic patterns.
• Investigate unexpected outbound data transfers and connections to suspicious destinations.
• Check whether the activity involves multiple devices, network segments or user accounts.
• Apply appropriate containment measures to prevent further unauthorised communication.

Effective network visibility is essential here. If firewall policies, network segmentation and monitoring are poorly configured, suspicious activity can be harder to identify and contain.

4. Unfamiliar files, software or changes to your data

New user accounts, unexpected administrative privileges, unfamiliar applications, modified files or missing data may indicate that an attacker has gained access.

In more serious incidents, you may discover files that have been encrypted, ransom notes, disabled security tools or changes to backup systems. These can be signs of ransomware or an attempt to disrupt recovery.

Attackers may also modify security settings to make their activity harder to detect.

What to do next:

• Record the affected systems, files and changes, including when they were first noticed.
• Investigate unexpected account creation, privilege escalation and changes to security configurations.
• Check the integrity and accessibility of backups, ensuring they have not also been compromised.
• If ransomware is suspected, activate your incident response plan and involve the appropriate technical and leadership teams.

Avoid deleting suspicious files or immediately rebuilding affected systems before evidence has been preserved and the extent of the incident is understood. This can make it harder to establish how the breach occurred and whether the attacker still has access.

5. Security alerts, phishing activity or reports from users

Sometimes the first warning comes from your own security tools or employees.

EDR alerts, suspicious email reports, disabled antivirus services, unexpected mailbox forwarding rules and reports of phishing emails sent from legitimate company accounts can all point to a potential compromise.

A single alert may not confirm a breach, but several related indicators should be taken seriously.

What to do next:

• Triage security alerts according to their severity and potential business impact.
• Check whether suspicious emails or account activity have affected other employees.
• Investigate mailbox rules, delegated access and application permissions that may have been changed unexpectedly.
• Escalate credible indicators of compromise to your security team or incident response provider.

Security awareness is important, but employees should not be expected to identify and investigate every threat themselves. They need a clear process for reporting concerns and a security team equipped to respond.

What should you do if you suspect a breach?

If you recognise one or more of these warning signs, avoid jumping to conclusions, but don’t ignore them either. A structured response can help limit the impact while giving your technical team the information needed to investigate.

1. Activate your incident response process. Notify the appropriate IT, security and management contacts. Establish who is responsible for coordinating the investigation and making decisions.

2. Contain the threat. Depending on the circumstances, this may involve isolating affected endpoints, disabling compromised accounts or blocking malicious network connections. Containment should be coordinated carefully to avoid unnecessary disruption or the loss of evidence.

3. Preserve evidence. Retain relevant logs, security alerts, timestamps and forensic information. Avoid actions that could destroy evidence before the investigation has established what happened.

4. Establish the scope. Identify which systems, accounts and data may have been affected, how the attacker gained access and whether they still have a foothold in the environment.

5. Recover securely. Remove the attacker’s access, address the underlying vulnerability, restore systems from trusted sources and validate that security controls are working before returning affected systems to normal operation.

6. Assess reporting obligations. Depending on the incident and the data involved, UK organisations may have legal or contractual reporting obligations. For example, a personal data breach may need to be reported to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it where the applicable UK GDPR reporting threshold is met. Not every cyber incident is a reportable personal data breach, so assess the circumstances promptly and seek appropriate advice.

7. Review and strengthen your defences. Once the immediate incident is under control, identify what failed and what needs to change. This could include improving identity security, tightening firewall policies, strengthening endpoint protection, reviewing network segmentation or improving security monitoring.

Don’t wait for a breach to expose the gaps

Detecting a cyber breach early depends on more than having security products in place. Organisations need visibility across their users, endpoints and networks, together with the expertise to interpret alerts, investigate suspicious activity and respond effectively.

For many IT teams, the challenge is balancing these responsibilities with day-to-day demands, limited resources and an increasingly complex threat landscape.

ANSecurity helps organisations strengthen their cybersecurity through practical advice, technical expertise and ongoing support. With nearly 25 years of experience, we work alongside internal IT teams to assess security controls, investigate weaknesses and improve protection across the network and wider IT environment.

From firewall health checks and endpoint security to vulnerability management, threat detection and managed security services, we help businesses understand where they are exposed and what to do next, without automatically requiring them to hand over control of their environment.

Suspect a breach, or want to understand how prepared your organisation is?

Speak to ANSecurity about reviewing your security posture, improving threat visibility and building a response approach that works for your business.