Have you been Hacked?

October 20, 2025
2:21 am
Blog, Cyber Security Information, Cyber Security Tips

Have you been hacked?

You may be able to salvage the situation—don’t lose hope.

Today I’ll walk you through the steps we use to save systems, data, and sometimes the whole company.

What does “hacked” mean here?

An attacker has control of something you rely on: email (Microsoft 365/Google Workspace), accounting, bank, cloud apps, or devices (laptops, servers, phones). The goal is to stop the damage and preserve what you’ll need to fix it.

Important: don’t factory-reset or delete accounts/devices yet. You’ll likely destroy evidence you may need for recovery, insurance, or legal action.

Do these first

Contain the problem (without wiping evidence).

Force sign-out from all sessions; temporarily block sign-ins for impacted users.
Turn on MFA everywhere.
Revoke suspicious OAuth/app tokens and shared delegates/forwarding rules.
For a device actively encrypting or beaconing, power it off. Otherwise, disconnect it from the network and leave it on (helps preserve state).

Find the entry point.

Check audit/sign-in logs for successes/failures and unusual locations/devices.
Look for new inbox rules/forwarding, new admins, or app consents.
Note times and systems touched—start a simple incident log.

Remove the attacker and artifacts.

Kill persistence: delete rogue accounts, tokens, inbox rules, scheduled tasks.
Remove malware/tools left behind; patch obvious gaps; rotate credentials and API keys.

Raise the floor (so it doesn’t happen again).

Enforce MFA, strong passwords, device patching/EDR/AV.
Turn on and keep log retention long enough to spot future issues.
Review admin roles and least-privilege access.

What we deliver at Cenegi

While we’re containing the incident, we also build an evidence-backed report: clear timeline, proof (screenshots, logs, exports), and pragmatic fixes you can implement. When needed, we package findings as a Forensics Review Report suitable for counsel/insurers.

Need help right now?

Thanks for reading. Next week: how a Forensics Review works and what you’ll actually receive.