What Happens If Your Business Gets Hacked?

It Won’t Happen to Us

That’s what most business owners believe. And it’s understandable — cyber attacks feel like something that happens to big corporations, not to a 30-person company in the Central Valley or a medical practice in Sacramento.

The reality is very different. Today’s cyber attacks are:

• Automated — attackers don’t hand-pick victims. Bots scan millions of businesses looking for weak points.
• Targeting small and mid-sized businesses — because they typically have weaker defenses than large enterprises.
• Often caused by simple mistakes — like clicking a link in an email that looks legitimate.

This article walks through what actually happens when a business gets compromised. Not in theory — but in the real-world timeline that plays out over and over again.

One caveat before we start. The timeline below is a composite, not a stopwatch. Some attacks run start to finish in a few hours. Others sit quietly inside an environment for weeks or months before anything visible happens, which is why the discovery date and the intrusion date are almost never the same day. The sequence is remarkably consistent. The clock is not.

Hour 0: The Click

It almost always starts with something simple. An employee:

• Clicks a link in a phishing email that looks like it came from Microsoft, a vendor, or a coworker
• Enters their username and password on a fake login page that looks identical to the real thing
• Opens a malicious attachment — a PDF, a Word document, or a voicemail notification

At this moment, there are no alarms. No pop-ups. No obvious signs that anything went wrong. The employee goes about their day. The attacker now has a set of valid credentials.

Hours 6–24: Silent Access

This is the phase most people don’t realize exists. The attacker isn’t rushing — they’re exploring.

With the stolen credentials, they now have access to:

• Email — they can read every conversation, see every attachment, and understand who in your organization handles money
• Cloud services — Microsoft 365, SharePoint, OneDrive, shared drives
• Internal systems — anything the compromised employee had access to

During this phase, the attacker is likely:

• Reading email threads to understand your business relationships
• Setting up email forwarding rules so they continue receiving messages even if the password is changed later
• Identifying who handles invoices, wire transfers, or sensitive data
• Sending emails from inside your company to vendors, customers, or colleagues

Most businesses have no idea this is happening. Without identity threat detection or email monitoring, there is nothing to trigger an alert.

Day 2: Escalation

If the attacker wants more than just email access, this is where they go deeper. They begin:

• Moving laterally — jumping from one system to another, using the access they already have to discover new targets
• Attempting admin-level access — looking for domain admin credentials, server access, or backup systems
• Disabling protections — turning off antivirus, deleting backup snapshots, modifying security policies

At this stage, the attacker is preparing for maximum impact. They want to make sure that when they strike, recovery is as difficult as possible.

Day 3: The Event

This is where the damage becomes visible. The attack takes one of three forms — sometimes more than one simultaneously.

Scenario A: Ransomware

You arrive at work to find every computer displaying the same message. Files are encrypted. Systems are locked. A ransom demand appears on screen — and the number is not drawn from a price list. Attackers size the demand to what they believe your business can pay, often after reading your financials on the way in, which is why any published “average ransom” tells you almost nothing about what you would be asked for. Your backups may have been deleted. Your servers are down. Nobody can work.

Scenario B: Data Theft

Sensitive files have been copied out of your environment. Customer records, employee information, financial data, contracts, intellectual property. The attacker may threaten to publish the data unless you pay, or they may sell it on the dark web. If you’re in healthcare, this is now a HIPAA breach with mandatory notification requirements.

Scenario C: Financial Fraud

Using the email access they’ve had for days, the attacker sends a convincing email — from a real employee’s account — requesting a wire transfer, changing payment instructions on an invoice, or redirecting a vendor payment. Because the email comes from inside your organization, it often succeeds. These losses are rarely recoverable.

What to Do in the First 24 Hours After You Find Out

Everything above describes the attack. This next part is the bit you actually control, and it is where most of the recoverable value is won or lost. The first day after discovery decides how much of your business you get back, how quickly, and in what condition. Work through these roughly in order.

1. Isolate the affected machines — but do not power them off. Pull the network cable, disable Wi-Fi, drop the VPN connection. Do not shut anything down. Powering off wipes memory-resident evidence — running processes, encryption keys still in RAM, network connections — that forensic investigators and your insurance carrier may need to establish what happened and what was actually taken. Isolating contains the spread. Shutting down destroys the record.
2. Call your IT provider or an incident response team before you change anything else. The instinct to start “fixing” is strong and it is usually the wrong instinct. Someone who has worked incidents before will tell you what to touch and what to leave alone, in that order.
3. Notify your cyber insurance carrier immediately. Most policies require prompt notice, and many require that you use their panel of approved forensics and legal vendors. Bringing in your own people first can complicate or reduce your coverage. If you are not sure whether you have a cyber policy, find out today rather than on the worst morning of the year.
4. Preserve the evidence. Leave logs, mailboxes, and affected systems intact. Do not reimage a machine to “get someone working again.” Photograph or screenshot ransom notes and unusual messages. Note the exact time each symptom was first observed and by whom. Sign-in and audit logs in Microsoft 365 have retention limits, so tell your provider early if you suspect email involvement — some of those logs age out.
5. Rotate credentials from a device you know is clean. Email, domain and cloud admin accounts, VPN, remote access, banking, and anything that shares a password with those. Changing the password is only half the job: revoke active sessions and refresh tokens too, or the attacker simply keeps the session they already hold. Re-register multi-factor authentication for compromised accounts, and check every mailbox for forwarding rules the attacker created — those survive a password change and are the most commonly missed piece of cleanup.
6. Document everything as you go. A running timeline of what was discovered, when, who was told, and what action was taken. Your insurer will ask for it, your attorney will need it, and if the incident is reportable, regulators will expect it. Nobody has ever reconstructed this accurately from memory a month later.
7. Assume email is compromised and move your coordination off it. Use phone calls or a separate messaging channel to run the response. Before notifying customers, partners, or the public, talk to legal counsel — breach notification duties (HIPAA and California’s statutes among them) carry specific deadlines and specific required content, and a well-meant early email can create problems that outlast the incident.

Two things not to do. Do not pay a ransom before your provider, your insurer, and legal counsel have all weighed in — payment carries sanctions exposure and buys a decryption tool that is frequently slow and incomplete. And do not quietly restore from backup before someone has established how the attacker got in. Restoring into an environment with the original hole still open is how a business gets hit twice in the same month.

The Business Impact

Even a single incident can result in:

• Days or weeks of downtime — no email, no files, no business systems
• Lost revenue — you can’t invoice, can’t serve customers, can’t operate
• Recovery costs — forensic investigation, system rebuilds, security remediation. For a small business, recovering from a serious incident routinely runs into the tens of thousands of dollars once you count forensics, rebuild time, and lost work — before any ransom, fine, or lost customer.
• Reputational damage — customers and partners lose trust
• Legal and compliance consequences — mandatory breach notifications, potential lawsuits, regulatory fines

In many cases, businesses are forced to rebuild their entire IT environment from scratch, notify every affected customer individually, and file insurance claims that take months to resolve.

What separates the businesses that come through an incident from the ones that limp for months afterwards is almost never luck, and it is rarely the sophistication of the attack. It is preparation — backups that were actually tested, an environment somebody has documented, and a plan for the first phone call. The attack itself is survivable. Being unprepared for it is what turns a bad week into a bad year.

Why This Happens

The attacks described above succeed not because of sophisticated hacking — but because of gaps in basic defenses that most small businesses don’t know they have:

• Weak email protection — basic spam filtering is not enough. Modern phishing emails bypass standard filters routinely.
• No endpoint detection — traditional antivirus catches known threats. It misses fileless malware and the living-off-the-land techniques modern attackers rely on, which is why EDR has replaced antivirus alone as the baseline.
• No identity monitoring — without monitoring for suspicious sign-ins, impossible travel, or unauthorized email rules, compromised accounts go undetected for days or weeks.
• Missing or incomplete backups — backups that aren’t tested, aren’t isolated from the network, or don’t cover all critical systems are useless when ransomware hits.
• No vulnerability management — unpatched software and misconfigured systems are open invitations. Regular vulnerability scans and penetration testing catch these before attackers do.

How to Prevent It

The key is not reacting after the fact — it’s preventing the attack from succeeding in the first place. And if it does get through, ensuring you can recover quickly.

A modern cybersecurity defense includes:

• Advanced email security — AI-powered filtering that catches phishing attempts that basic spam filters miss. Email is where most of these stories start, which is why attackers target small business inboxes first
• Endpoint detection and response (EDR) — monitors every workstation and server for malicious behavior in real time, not just known virus signatures
• Identity threat detection — watches your Microsoft 365 accounts for compromised credentials, suspicious sign-ins, and unauthorized changes
• Vulnerability scanning and penetration testing — regularly tests your defenses to find and fix weaknesses
• Dark web monitoring — alerts you when employee credentials or company data appear for sale
• Tested backup and disaster recovery — isolated backups that are verified regularly, so you can restore operations in hours, not weeks
• Employee security training — because the best technical defenses in the world can’t stop an employee who willingly enters their password on a fake page
• 24/7 Security Operations Center — real humans monitoring your environment around the clock, not just automated alerts that nobody reads

No single tool stops every attack. The businesses that stay safe are the ones with layered defenses — multiple overlapping protections that work together so that if one layer is bypassed, the next one catches it.

The Bottom Line

Cyber attacks are no longer rare events that happen to other people. They are everyday business risks that affect companies of every size, in every industry, in every city.

The question is not whether your business will be targeted — it’s whether you’re prepared when it happens.

If you’re not sure where your business stands, we can help. A quick Cyber Risk Snapshot takes about 15 minutes and identifies the specific gaps in your defenses — before an attacker finds them first.

Related Questions