The ransom note does not care how small the business is. A dental practice, a haulier with forty trucks, a solicitor’s office with nine staff — ransomware gangs target small firms precisely because they are small: valuable data, real money, and security that consists of hope and a part-time IT contract. The encouraging shift is that the defences which actually work are neither exotic nor expensive. They are specific, boring and, increasingly, being adopted before the incident rather than after it.
The attack pattern is depressingly standard. Entry comes through a phished password, an unpatched remote-access service or a supplier’s compromised account. The intruders move quietly for days, find the backups, and only then detonate encryption — which is why the incident always seems to arrive at the worst moment, usually a weekend, always with the backups already dead. The incidents and recoveries documented at our home page teach the same curriculum, firm by firm.
Why Small Means Exposed
Large companies buy security teams; small firms buy software and assume it suffices. Attackers price that assumption professionally. Guidance from the National Cyber Security Centre aimed at small businesses stresses the asymmetry: the gang needs one reused password or one missed update, while the firm must be right every day. Add flat networks where one compromised laptop can reach the file server, the accounts package and the backup drive, and a single click becomes a company-wide event.
There is also a psychological targeting at work. Small firms cannot absorb weeks of downtime; a restaurant group or a care provider faces closure, not inconvenience, when systems die. Gangs know the pressure converts directly into payment probability, which is why demands are calibrated with an accountant’s precision to the victim’s revenue — low enough to pay, high enough to fund the next hundred attacks.
The Defences That Actually Work
The counter-list is short because the evidence is consistent. Multi-factor authentication on every remote login and email account closes the commonest doors. Prompt patching of edge devices — the firewalls and remote-access boxes gangs scan for nightly — closes the next set. Backups must be offline or immutable, separated from the network the attacker will own, and, critically, restore-tested: a backup that has never been restored is a hypothesis, not a defence. The National Institute of Standards and Technology‘s small business resources make the same point in framework language: identify the crown jewels, protect them in depth, and rehearse recovery before it is needed.
In our our Cybersecurity coverage reporting, the firms that survive incidents share one further habit: segmentation. The guest Wi-Fi cannot see the tills; the tills cannot see the file server; the intern’s laptop cannot see anything it does not need. Segmentation turns a breach from a detonation into a burglary — serious, contained, recoverable. It costs configuration time, not capital, which is why advisers now recommend it ahead of almost any purchasable product.
When It Happens Anyway
Prepared firms also write the incident plan in peacetime: who decides, who calls the insurer and the lawyers, how customers are told, how the business trades on paper for a week. Paying the ransom, advisers and law enforcement consistently note, funds the industry, invites repeat targeting and frequently fails to restore everything anyway. The firms that recover fastest are those for whom the incident is a procedure, not an improvisation.
Ransomware will not stop favouring small targets; the economics forbid it. But the gap between the prepared small firm and the unprepared one is now the widest variable in the entire crime model — wider than the gang’s skill or the ransom’s size. A weekend spent on authentication, backups and segmentation is, measured against the alternative, among the highest-return weekends a business owner can buy. The gangs are counting on it never happening.
