Every business that stores data online faces the risk of a breach. Good security reduces that risk: regular scans for network anomalies, strong encryption, and a culture where employees watch for unusual activity and report it. Alert staff are a first line of defense against data leaks, identity theft and other attacks.
Knowing the signs of a data breach lets you detect it early and respond quickly. This article covers the main warning signs, from unusual network patterns and changes in user behaviour to phishing, ransomware and malware, and what to do once you have found a breach.
Unusual network patterns
Unusual network patterns are often the first sign of a breach. Watch for:
Unusual file and network activity
- abnormal access patterns and database activity,
- unexpected file changes, such as strange file extensions or locked files,
- pop-up messages demanding payment, which signal ransomware,
- and strange file transfers or login attempts.
Performance and traffic anomalies
- slow computers or an unexplained slow internet connection,
- intermittent network access,
- changes in traffic volume, including activity on unusual network ports,
- and traffic from or to odd places, protocol violations and unauthorized scans.
To catch these, businesses need the right set of network security measures:
- Network security tools. Intrusion detection and prevention systems (IDS and IPS), data loss prevention (DLP), security information and event management (SIEM), network behaviour anomaly detection (NBAD) and security information analytics.
- Monitoring and detection. Track and filter network traffic and events regularly. Use network monitoring tools to spot suspicious patterns, and bring in vulnerability scanning and penetration testers to find the gaps in your network configuration, software and hardware.
- Anomaly detection models. These build a baseline of normal network activity and flag anything that departs from it significantly, including signs of phishing, malware, DoS and DDoS, man-in-the-middle attacks, SQL injection and XSS.
Watching for these signs, with the right tools in place, makes you much harder to breach unnoticed.
Unexpected changes in user account behaviour
How your users’ accounts behave is one of the clearest signs of a breach.
Unusual logins and access requests
- multiple failed login attempts,
- and requests to access sensitive data with no clear need.
Password and credential changes
- unauthorized password resets or credential changes,
- and sudden account lockouts or changes to group memberships.
Some changes slip under the radar but are strong signs of a breach:
Sudden infrastructure changes
- changes to critical system passwords and accounts,
- and losing access to network, email or social media accounts.
Administrative trouble
- problems with administrative logins,
- and difficulty reaching management functions.
Account abuse and anomalous activity should raise an immediate red flag:
- audit trails that have been modified,
- shared account access,
- logins at odd times or from unusual locations,
- and user actions that do not match the user’s usual devices.
Anomalies in file access and changes
Unusual file access and changes are strong signals of a breach. Spotting them takes careful monitoring.
Early signs of compromise
- more phishing attempts, followed by unauthorized access alerts,
- antivirus alerts that malware is present,
- scrambled file names or contents, which point to ransomware,
- and computers locking up or files suddenly becoming inaccessible.
File integrity monitoring (FIM)
- What it is for: FIM detects unauthorized changes in real time. It protects data integrity and supports compliance with standards such as PCI DSS.
- How it works: FIM checks the integrity of files, registry keys and folders, and alerts administrators when they change by comparing them against a known baseline.
Unusual file activity
- files created, changed or deleted by someone without authorization,
- suspicious or unknown files appearing, which may be malware,
- and sudden, unexplained changes to system files, often made quietly by attackers.
Knowing these signs and monitoring for them with tools such as FIM makes a big difference to how quickly you catch an attack.
Signs of phishing
Phishing often comes before a data breach, so treat unexpected messages with caution. Phishing takes several forms, all designed to trick people into handing over sensitive information.
Types of phishing attack
- Business email compromise (BEC): fraudulent emails aimed at companies.
- Credential theft: attempts to steal login details.
- Malware: malicious software designed to harm or exploit any device or network.
- QR code phishing: QR codes that lead victims to phishing sites.
- Ransomware: data held hostage for payment.
- Smishing and vishing: phishing by text message (smishing) or voice call (vishing).
How to recognize a phishing email
- it demands urgent action,
- the email address, links or domain names do not quite match,
- it asks for login details, payment information or sensitive data,
- it has spelling and grammar mistakes,
- or it carries suspicious attachments.
Phishing awareness training and email threat detection services help protect against these attacks, and threat intelligence reports such as Cofense’s phishing trends reviews show what attackers are doing now. Report suspicious emails to [email protected], and in the US and UK forward phishing text messages to 7726 (SPAM). The UK’s National Cyber Security Centre has guidance on defending against phishing.
Ransomware and malware indicators
Attackers use sophisticated techniques to get ransomware and malware into business networks. Spotting the signs early gives you time to act.
Early signs
- error messages or warnings from browsers and antivirus tools,
- unusually high system, disk or network activity,
- unexpected software or processes appearing,
- crashes, and alerts that your malware protection has been disabled,
- and abnormal browsing behaviour, such as pop-ups, redirects or changed browser settings.
Prevention
- Train users to recognize and report phishing emails and suspicious activity.
- Keep software up to date, and use strong passwords with multi-factor authentication.
- Back up and test recovery. Keep offline, encrypted backups of critical data and make sure you can restore them quickly.
- Layer your defenses, with security platforms that cover endpoints, network and users together.
Response
- Disconnect affected machines from the network as soon as you detect ransomware.
- Activate your security incident response plan.
- Review network alerts regularly, run firewalls and carry out risk assessments.
These steps make you far more resilient to ransomware and malware, and protect customer data and your finances and reputation.
What to do after detecting a breach
Once you detect a breach, act quickly and in order.
- Immediate actions
- Work out what was exposed: your data and your users’ data.
- Stop further data loss: secure systems, fix the vulnerabilities and secure any physical areas involved.
- Mobilize your breach response team: including a data forensics team and legal counsel.
- Investigation and mitigation
- Analyze user activity: examine outbound connections to find suspicious network activity.
- Close the gaps: use anomaly detection and data exfiltration alerts to catch abnormal use in real time.
- Preserve evidence: document the investigation thoroughly without changing the systems involved.
- Notification and recovery
- Notify the people affected: follow the laws that apply to you and the nature of the breach.
- Offer support: provide at least a year of free credit monitoring or identity theft protection.
- Work with law enforcement: agree what to include in breach notices so you do not hamper their investigation.
Fast action, a thorough investigation and responsible notification are how you manage a data breach well. Our guide to creating a cyber incident response plan covers how to prepare in advance.
Conclusion
Awareness and preparation are what protect a business. Spotting unusual network patterns, unexpected changes in user behaviour and anomalies in file access are the key steps to early detection. Add employee training on phishing and a solid response plan, and you have the foundation of an effective defense.
Working with security experts adds another layer of protection. A penetration test shows you the routes an attacker would use before one of them does. Contact us to scope a penetration test and reduce your risk of a breach.
FAQs
What do businesses do after a data breach?
After a breach, businesses check whether protections such as encryption were active at the time, verify the integrity of backups, review access logs to see who could reach the compromised data, and review current access permissions, removing any that are not needed.
What should I do if my personal data has been compromised?
Act quickly. Seven recommended steps:
- Change your passwords immediately.
- Turn on two-factor authentication.
- Follow updates and advice from the affected company.
- Monitor your financial accounts and check your credit reports for unusual activity.
- Consider an identity theft protection service.
- Freeze your credit to prevent unauthorized use.
- In the US, report the incident at IdentityTheft.gov for help and guidance.
Do companies have to tell you about a data breach?
Under UK and EU GDPR, yes: companies must tell individuals directly and without undue delay if a breach is likely to result in a high risk to their rights and freedoms. That threshold is higher than the one for notifying the regulator, such as the Information Commissioner’s Office (ICO). Other countries and US states have their own notification laws.
How can you tell if your data has been breached?
Watch for red flags such as being unable to log into your accounts, security settings that changed without your knowledge, and messages or notifications about actions you did not take.