A lot of owners figure they're too small to be worth hacking. Nobody overseas has ever heard of a four-chair dental office in Covington, so why would anyone bother?
Because nobody has to hear of you. Most attacks on small businesses aren't aimed at anyone in particular. They're automated. Somebody buys a list of leaked passwords and tries them against every Microsoft 365 login they can find. Somebody else sends the same fake invoice to a huge list of inboxes and waits for one person to click.
You don't get picked. You get found.
What they want from a small office
It's easy to assume your data isn't interesting. You don't have trade secrets. You sell insurance, or pour concrete, or clean teeth. From the attacker's side, though, a small business has plenty worth taking.
- Money, mostly. Either a ransom to get your files back, or a payment redirected to their account after they get into your email.
- Customer records. Dates of birth, Social Security numbers, insurance details, card numbers. A dental office or a CPA firm holds exactly the kind of data that sells.
- Your email account. From inside a real mailbox, they can send invoices to your customers that look legitimate, because they really are coming from you.
- A way into someone bigger. If you do work for a hospital, a school district or a large general contractor, your access to their systems can be worth more than anything you own.
The email one deserves a closer look, because it doesn't need any clever malware. Picture a Hammond contractor whose bookkeeper gets an email from a supplier they've paid for years: we've changed banks, please use the new account for the next payment. The email really did come from the supplier's account. The supplier just didn't know someone had been quietly reading their mail for weeks.
Why small offices are easier
Small business owners aren't careless. They're busy. Everybody has three jobs, and IT ends up as the fourth job for whoever is least afraid of the printer.
That usually looks something like this. The Wi-Fi password is taped under the front desk keyboard. The same password gets used for email and the bank. The receptionist who left two years ago can still log in. The backup is an external drive in the closet that nobody has checked since the day it was plugged in.
None of that is unusual, and attackers count on it. A large company has people whose whole job is noticing a strange login at 3 a.m. At a small office, the strange login at 3 a.m. just happens, and nobody finds out until a customer calls about an odd invoice.
The basics stop most of it
You don't need a bank's security budget. Most small business breaches start with something ordinary: a reused password, an unpatched computer, an email someone shouldn't have trusted. Closing those gaps isn't exotic work.
- Turn on multi-factor authentication for email, banking and anything else that offers it. On its own, it blocks most password-based attacks.
- Give everyone their own login, and shut accounts off the day someone leaves.
- Keep computers and software patched. Most updates are security fixes, and clicking "remind me tomorrow" for six months is how old holes stay open.
- Back up somewhere other than the office, and test a restore now and then. A backup nobody has ever restored from is really just a hope.
- Teach your team what phishing looks like, and make it normal to pick up the phone and verify any request to change payment details.
- Put real endpoint protection on every computer, the kind that watches for ransomware behavior instead of only checking a list of known viruses.
None of this is glamorous, and it doesn't need to be. The businesses that get hurt worst are rarely the ones someone targeted with a brilliant plan. They're the ones with one of the gaps above that nobody knew about.
If you're not sure which of those gaps your office has, that's what our free assessment is for. We'll look at your accounts, backups and security and tell you plainly what we'd fix first.
