Phone Number
877.832.4180Email
info@techmedics.comPasadena, CA
45 S. Arroyo Pkwy. Ste. 104
Pasadena, CA 91105
Pasadena, CA 91105
Denver, CO
383 Corona St. Ste. 100 Denver, CO 80218
Dallas, TX
2451 W. Grapevine Mills Cir. #541 Grapevine, TX 76051
Most business owners picture a cyberattack as something loud: a ransom note on every screen, a website that won’t load, a phone that won’t stop ringing. Some attacks do look like that. Many start much more quietly, with someone logging in as one of your employees and looking around.
The short answer: you often find out from small oddities rather than alarms. It might be an email rule no one remembers creating, a login approval request the employee never triggered, or a vendor calling to ask why your bank details changed. Mandiant, Google’s threat-intelligence and incident-response team, found that intruders in the 2025 attacks it investigated went unnoticed for a median of 14 days. In only 52% of cases did the organization find the problem itself. In the rest, someone outside the company had to tell them.
That gap matters because every quiet day gives an attacker time to read email, learn who approves payments, and set up ways back in. Spotting the early signs can turn a serious incident into a contained one.
In this blog post, we will explain why break-ins often go unnoticed, walk through five warning signs that owners and employees can spot without technical tools, and list the questions worth asking your IT provider. We will also show how Techmedics’ managed security services can help you catch what people miss.
Security teams call the time between a break-in and its discovery “dwell time.” It tends to run long when the attacker doesn’t need to break anything. Someone who signs in with a stolen password looks, to most systems, like an ordinary employee checking email. Passwords leak in many ways, including reuse across sites that were breached.
Unnoticed access also tends to come back later. Mandiant calls this “prior compromise,” meaning access from an earlier break-in that was never cleaned up. It was the third most common way attackers got in during 2025. It was also the top way into ransomware attacks, at 30%, double the year before. A quiet intrusion this month can become a ransomware attack next month.
One caveat: Mandiant’s figures come only from incidents it was called in to investigate, so they may not reflect smaller businesses. A small business without anyone watching its logs may take longer to notice, not shorter.
Multifactor authentication (MFA) adds a second check, such as tapping “approve” on a phone, after the password. If an employee gets approval requests they didn’t trigger, the password may already be stolen. The Cybersecurity and Infrastructure Security Agency (CISA), the federal government’s cyber defense agency, describes a tactic called “push bombing,” where attackers flood a phone with requests until the user taps “approve” by accident or just to make them stop. A related trick is a phone call from fake “IT support” asking the employee to approve a prompt, the same approach behind recent helpdesk impersonation scams. Voice phishing was the second most common way in across Mandiant’s 2025 investigations, at 11%.
Microsoft 365 lets users report an unexpected prompt as suspicious, which flags the account as high risk for an administrator. That option stays off unless an administrator turns it on.
CISA’s preferred fix for push bombing is phishing-resistant MFA, such as a physical security key. As an interim step, it recommends number matching, where the user types a code shown on the login screen before approving. Not every MFA method offers the same protection, as the risks of text-message codes and SIM swapping show.
Once inside a mailbox, attackers often set up inbox rules (automatic sorting instructions) to hide their tracks. Microsoft’s own guide to compromised email accounts lists several warning signs. One is a rule forwarding mail to unknown addresses. Another is a rule moving messages into rarely opened folders such as Notes, Junk Email, or RSS Subscriptions. Email that goes missing or gets deleted is a third. If an employee says replies from a client “never arrived,” that is worth a closer look.
Microsoft’s list also includes odd messages sitting in Sent Items or Deleted Items, such as an “I’m stuck in London, send money” note. Another sign is a mailbox suddenly blocked from sending email, which Microsoft says is likely if the account was used to send spam or a high volume of email. Clients or coworkers replying to messages you never wrote point in the same direction.
Business email compromise (BEC) is fraud in which a criminal uses a real or look-alike email account to redirect payments, often by sending “updated” bank details. The FBI’s Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints and more than $3 billion in reported losses in 2025. California and Texas ranked first and second in reported losses across all internet crime that year. Both states are home to Techmedics markets, including Los Angeles, Pasadena, Irvine, and Dallas.
The warning sign often arrives from outside. A supplier asks why you changed your remittance details. A client mentions the invoice “you” resent. Home closings are one place this shows up. IC3’s own 2025 case examples include a fraudulent wire of more than $1.3 million tied to fake title company instructions. The FBI recommends confirming any change in payment details through a second channel, such as a phone number you already have on file.
Microsoft also points to frequent password changes, unexplained lockouts, edited contact details in the company directory, and strange new email signatures. Its cleanup steps go further: check for new sign-in devices or MFA methods, apps the user granted access to, and administrator rights the account shouldn’t have. An owner won’t see most of these directly, but an employee saying “I keep getting locked out” is a cue to ask your IT provider to check.
Call your IT provider first, by phone. Microsoft advises against emailing a new password to the affected user, since the attacker may still be reading that mailbox. The usual first steps are disabling the account, signing it out everywhere, and removing any rules or forwarding the attacker added. If money has already moved, contact your bank and file a report at ic3.gov quickly, since the FBI notes that time matters when trying to freeze fraudulent transfers.
If you’re not sure whether anyone would notice a quiet break-in at your business, request a consultation today with Techmedics.
Technology challenges rarely have one-size-fits-all solutions. A consultation with Techmedics can help you better understand your options and identify practical next steps for your organization. Start with a conversation about what you're trying to accomplish and where technology may be getting in the way.
