The best evidence of a hack is in your sign-in logs, not on the computer

Where people look, and where they should

When someone thinks their work computer has been hacked, they usually describe the computer: it’s slow, the fan is loud, a strange window popped up, the cursor moved. Most of the time, those turn out to be Windows being Windows. The signs that really matter in a business today are rarely on the computer at all. They’re in your Microsoft 365 or Google Workspace account: a sign-in from a country nobody visited, a phone prompt you didn’t ask for, a mailbox rule you didn’t create, an administrator account nobody recognizes.

That’s my firm view, and the reason is simple. In my experience, most attacks on small businesses now go after the account rather than the machine, because the account is where the email, the files and the money conversations live. An attacker with your password and a valid session doesn’t need to touch your laptop. So if you only check the laptop, you can give it a clean bill of health while someone reads your inbox.

Signs that mean something, roughly most serious first

1. A sign-in approval or code you didn’t ask for. If your phone asks you to approve a sign-in and you weren’t signing in, someone has your password. Deny it, then change the password straight away. Repeated prompts in a row are a known trick called “push bombing”, where attackers keep asking until a tired person taps yes. CISA’s fact sheet on number matching is aimed at exactly this.
2. Mailbox rules or forwarding you didn’t set up. Microsoft lists these among the common symptoms of a compromised mailbox: rules that forward mail to unknown addresses, or move messages to folders like Notes, Junk Email or RSS Subscriptions. Attackers use them to hide replies during invoice fraud.
3. Sent or deleted messages you don’t remember. Colleagues or clients asking about an email you never sent, or bounce-backs for messages you didn’t write.
4. Unknown sign-ins in your activity history. Locations, devices or browsers you don’t use, especially successful ones.
5. New admin accounts or new sign-in methods. An administrator nobody can explain, or an extra phone or authenticator app registered on your account. Attackers add these so they can get back in after you change the password.
6. Apps you didn’t approve with access to your account. A “PDF viewer” or “mail organizer” with permission to read your mail is a quiet way to keep access.
7. Your security software has been switched off, and you didn’t do it. Disabling protection is often one of the first things malware tries.
8. Password resets or lockouts you didn’t cause, or account details such as your phone number changed in the company directory.
9. Questions about money, such as a vendor saying they never received payment, or a client saying they paid the new bank details “you” sent. By this point the account has usually been compromised for a while.

Things that are usually just Windows being Windows

None of these prove you’re safe, but on their own they’re weak evidence of a hack, and I’d rather you didn’t lose a morning worrying about them.

• The computer is slow, especially after an update or on Patch Tuesday (the second Tuesday of each month, when Microsoft releases security updates).
• The fan runs loudly while Windows indexes files or OneDrive syncs a large folder.
• A pop-up in the browser says your computer is infected and gives a phone number. That’s a scam web page, not a sign of infection. Close the tab, and never call the number.
• A restart you didn’t expect, after updates installed overnight.
• The cursor moves on its own once. Wireless mice do that. If it moves with purpose, opens programs and types, that’s different: unplug the network and call IT.

The ransomware call that wasn’t

An office manager at a 30-person services business called us because several files had suddenly become inaccessible, and she thought ransomware had hit the network. That’s a reasonable fear, and we treated it as one. We isolated the affected workstation as a precaution, then checked the endpoint alerts, the file extensions, recent process activity and the audit trail on the shared folder.

The files weren’t encrypted. A user had reorganized the shared directory, a synchronization client had then moved a folder, and the mapped-drive shortcut still pointed to the old path. We put the folder back where it was meant to be, confirmed the permissions, and went through version history for any missing edits.

The step I’d point out came after that. One harmless explanation doesn’t make the whole environment clean, so before closing the ticket we still reviewed recent sign-in activity and the status of endpoint protection, the same places I’d tell anyone to look. The lasting fix was about ownership: each shared folder got a clear owner, and personal sync folders stopped doubling as a department’s file system.

A check you can do without admin rights

It takes about ten minutes. If you’re on Microsoft 365:

1. Go to mysignins.microsoft.com, open Recent activity, and expand each sign-in. Microsoft says to change your password if you see one you don’t recognize.
2. On the same site, open Security info and check the list of phones and authenticator apps. Remove anything that isn’t yours, and tell IT that you did.
3. In Outlook on the web, go to Settings, then Mail, and look at Rules and Forwarding. Anything you didn’t create is a red flag.
4. Look through Sent Items and Deleted Items for the last week.

On Google Workspace, the equivalent is the Security page of your Google Account: recent security activity, your devices, and third-party apps with account access, plus filters and forwarding in Gmail settings.

If you’re the owner or the IT person, go one level further. The Microsoft Entra sign-in logs show every account’s sign-ins with IP address, location and success or failure. Check the list of Global Administrators. Check which apps users have consented to. Google’s admin console has the same kind of login audit for every user. This is where an attacker who has been sitting quietly in one mailbox for three weeks shows up.

If you find something

Don’t start deleting things on your own. Tell whoever runs your IT, take the computer off the network if the computer itself seems to be involved, and change your password from a different device. An admin then needs to revoke your sessions, remove any rules, forwarding, unknown sign-in methods and app permissions, and check whether anyone else was hit. Our step-by-step for a hacked business email account covers the full sequence.

If you’d like to know whether anyone would notice these signs in your business before a client does, that’s a question our free Technology Health Assessment answers, along with the rest of your security and IT. It takes 30 minutes of data collection, the plain-language report arrives the next day, and it’s yours to keep. Pick a time for the assessment.

Making these signs show up by themselves

Everything above relies on someone looking, and people mostly don’t look until something feels wrong. The better setup is alerts that come to you: a notification when a new forwarding rule is created, when an admin role is assigned, or when a sign-in comes from somewhere unusual, plus endpoint protection that reports to someone who reads the reports. Phishing-resistant sign-in methods (passkeys or security keys) for admins and finance staff remove most of the push-bombing problem in the first place. That’s the kind of work our cybersecurity service covers, and our guide to Microsoft 365 security settings lists the switches if you’d rather do it yourself.

Related services

• Cybersecurity services
• What to do if your email is hacked
• Microsoft 365 security settings
• Free Technology Health Assessment