What Happens During a Cyberattack: The 5-Stage Timeline

The Hook

It’s 2 a.m. Nobody’s watching the network. An employee clicked a link three days ago that looked like it came from a vendor. By the time anyone notices, the attacker has already been inside for days — quietly gathering passwords and mapping out where the valuable data lives. This isn’t a movie scene; it’s the average pattern behind small business breaches happening right now. Understanding what happens during a cyberattack, stage by stage, is one of the most powerful things a business owner can do — you can’t defend against a process you don’t understand.

Most people picture a cyberattack as one dramatic moment: a screen going dark, a ransom note appearing. In reality, it’s a process that unfolds over days or weeks before anyone notices. Here’s exactly what happens during a cyberattack, from first breach to final demand.

Stage 1: Initial Compromise — How a Cyberattack Begins

Think of this like a burglar checking doors and windows until one is unlocked. The most common ways in:

• A phishing email that tricks someone into entering their password on a fake login page
• A weak or reused password exposed in an unrelated breach
• Outdated software with a known, unpatched vulnerability
• A misconfigured remote access tool left open like a back door

Once the attacker has one working set of credentials, they’re in. Often, they don’t act right away — they wait, watch, and plan.

Stage 2: Lateral Movement — The Cyberattack Spreads Quietly

Getting into one account isn’t the goal — it’s the starting point. Attackers spend this stage moving from system to system looking for bigger prizes: an admin account, a finance computer, a server full of customer records. This “lateral movement” can go undetected for a long time if a business has no way to monitor unusual network activity. It’s also why reusing passwords across systems is so dangerous — it hands the attacker a master key.

Stage 3: Data Theft — Cyberattacks Steal Data Before Locking It

Modern attacks rarely stop at locking up files. Before encrypting anything, attackers usually copy sensitive data — customer records, financial information, employee data — to servers they control. This step, called exfiltration, gives them leverage later: even if you restore from backup, they can still threaten to leak or sell what they stole.

Stage 4: Encryption — The Moment a Cyberattack Becomes Visible

This is the stage most people associate with a cyberattack: files suddenly inaccessible, replaced with a ransom note. Encryption is deliberately the loud part — but by this point, the real damage, the theft and the access, has already happened.

Stage 5: Extortion — The Cyberattack’s Final Pressure Campaign

Now the demands arrive: a ransom for the decryption key, a separate demand to prevent leaked data from going public, sometimes even threats to notify your customers or regulators directly. Encryption plus the threat of a leak — “double extortion” — is now the standard playbook, not the exception.

Why Every Stage of a Cyberattack Matters

By the time you see a ransom note, you’re at the end of the attack, not the beginning. Every earlier stage — the phishing email, the reused password, the unpatched software — is a chance to catch it first. Industry data shows the median time from intrusion to ransomware execution has dropped to just five days, so that detection window is narrow and shrinking.

The stakes back this up: a 2026 Verizon study found small businesses face a median incident impact of about $38,000, with ransomware and business email compromise driving the largest share of claims. For a small business, that’s rarely one-time — it’s lost operating capital, lost trust, and lost time. Knowing what happens during a cyberattack ahead of time is what turns that story around.

The 5-Minute Fix

Open one critical account right now — email, banking, or your admin login — and check whether multi-factor authentication (MFA) is turned on. If not, enable it today. MFA won’t stop every stage, but it makes Stage 1 dramatically harder to pull off, which stops the entire chain before it starts.

Learn More About How a Cyberattack Unfolds

For a technical breakdown of each phase, see CISA’s #StopRansomware Guide. For the real financial impact on businesses like yours, check out this 2026 small business cyberattack analysis.

What’s Next

This is Week 3 in our Small Business Cybersecurity Education Series. Next week: why cybersecurity is a business leadership problem, not just an IT one.

Wondering how many of these stages your business could currently detect — or stop? Reach out to the 2Bware team for a conversation about where your defenses stand today.