Your accountant calls you at 8:40 on a Tuesday morning. The invoices won't open. Your customer database is locked. And there, on your screen, is a countdown timer and a message in broken English demanding payment in Bitcoin within 72 hours.
I've watched this exact scene play out for a client of mine — a 9-person bookkeeping firm in Lyon. They paid the ransom. €14,000. And they still lost six weeks of work, because the decryption key they received unlocked about 60% of the files. The rest were corrupted beyond repair.
Ransomware prevention tips for small businesses tend to get written as if you have a full IT department and a six-figure security budget. You don't. So here's what actually matters when you have maybe twelve employees, one overloaded "IT person" who's really just the guy who knows how the printer works, and no appetite for a 40-page compliance document.
Key Takeaways
- Offline backups are your only real safety net. Not cloud sync. Not a NAS that stays connected. Physically disconnected or immutable copies.
- MFA on email is the single highest-return action — it stops the most common entry point cold.
- Ransomware gangs buy access, they don't break in. Usually from stolen credentials or unpatched remote access tools.
- Your recovery time depends entirely on how boring and rehearsed your restore process is.
- Cyber insurance is worth pricing, but read the exclusions on "failure to maintain reasonable controls."
- A one-page policy your team actually reads beats a 40-page one they ignore.
Why ransomware prevention tips for small businesses look nothing like enterprise advice
Big companies get hit too, but a small business fails differently. There's no incident response team on standby. There's no spare infrastructure to fail over to. The owner is often the one deciding whether to pay, at 2 a.m., with zero sleep and a furious client on hold.
Attacks on smaller organizations have climbed sharply over the past few years, and the reason isn't sophistication. It's arithmetic. A gang running automated scans finds thousands of small firms with exposed remote desktop ports and old software. Most are soft targets. The payoff per victim is smaller, but so is the effort.
Here's what surprised me when I started digging into how these groups actually operate: they rarely "hack" anything in the movie sense. They buy. They buy credentials from infostealer logs, they buy access to unpatched VPN appliances, they buy a list of companies with no MFA. Then they walk in through the front door with a valid login.
The three doors they actually use
Almost every small business breach I've seen traces back to one of these:
- Remote access tools left exposed — RDP, old VPN clients, a remote support tool nobody remembers installing
- Phished email credentials, especially when MFA is absent or was bypassed with a fake login page
- Unpatched internet-facing software — a website plugin, a file transfer tool, a router firmware from 2019
Notice what's not on that list: elaborate zero-day exploits and genius hackers. The bar is lower than you'd think. That's good news, because it means the defenses that work are also unglamorous.
Backups: the part almost everyone gets wrong
I'll be blunt. If you do nothing else in this article, fix your backups. Everything else is secondary.
The trap is that "we back up to the cloud" feels safe and often isn't. If your backup syncs continuously and your account credentials are compromised, the attacker deletes or encrypts the backups too. I've seen this happen. The owner was devastated because she genuinely believed she was covered.
The 3-2-1-1 rule, without the jargon
Keep three copies of your data, on two different types of storage, with one copy offsite, and one copy offline or immutable. That last part is the one that saves you.
Practically, for a small firm, that might look like:
- Local daily backup to a NAS or external drive
- Cloud backup to a provider that supports versioning and immutable snapshots
- A rotating external drive that goes home in someone's bag and stays disconnected the rest of the time
That third item sounds quaint. It's also the reason one of my clients recovered in two days instead of two months. The drive was in the owner's kitchen drawer when the attack hit. It was untouched.
Test the restore, not just the backup
A backup you've never restored is a hope, not a plan. I made this mistake early on: I set up what I thought was a bulletproof backup routine for a small agency and never tested it. When we finally tried to restore a deleted folder, the job had been failing silently for four months due to a permission error.
Pick one folder. Restore it. Time how long it takes. Multiply that by your total data volume. That number is your real recovery window, and it might terrify you.
The cheap wins: MFA, patching, and killing old accounts
None of this costs much. It just costs attention, which is harder to budget for.
Turn on multi-factor authentication for email, your accounting software, your banking, and any admin console you can log into remotely. Do it today, not next quarter. Email is the master key to almost everything else — password resets, invoices, client conversations — so it's the first thing to lock down.
Patching is the chore nobody wants. But a router or VPN appliance sitting unpatched for six months is an open invitation. Set a monthly reminder. Spend an hour. Update everything that faces the internet.
And then there's the account graveyard — ex-employees, old freelancers, test accounts someone created in 2021 and forgot. Every one of those is a door. When I audited access for a 15-person firm, I found 11 active logins belonging to people who no longer worked there. Two had admin rights.
Your people are the weak point, and that's fixable
Training doesn't have to mean a dreary annual video nobody watches. The most effective thing I've seen is a short, recurring, slightly uncomfortable simulation: send your own team a fake phishing email, and see who clicks. Then talk about it without shaming anyone.
A small manufacturing company I worked with did this monthly for a year. Click rates went from roughly half the staff down to one or two people. More importantly, people started forwarding suspicious emails to each other before opening anything.
| Measure | Typical cost for a small firm | Effort | Impact |
|---|---|---|---|
| MFA on email and key apps | Usually free to a few dollars per user/month | An afternoon | Very high |
| Offline/immutable backup | €20–€80/month for cloud, plus a drive | Setup weekend, then automatic | Very high |
| Monthly patching routine | Staff time only | 1–2 hours/month | High |
| Phishing simulation + training | Free tools to a few hundred/year | Recurring, light | High |
| Managed IT provider (MSP) | Often €50–€150 per workstation/month | Outsourced | High, if you pick well |
| Cyber insurance | Varies widely; can be steep for small firms | Paperwork | Moderate — read the exclusions |
What if you have no IT staff at all?
A managed service provider can carry most of this for you, and for a small firm that's often the sanest choice. But vet them. Ask specifically how they handle MFA rollout, backup immutability, and patch scheduling. If they can't answer in plain language, walk away. I've seen MSP contracts where "monitoring" meant a dashboard nobody looked at.
If you're under attack right now
Disconnect the affected machines from the network immediately. Don't shut them down — you may lose forensic evidence that helps recovery and any insurance claim. Call your IT provider, your insurer, and depending on where you operate and what data was involved, you may have legal notification obligations to clients or regulators. Don't pay before you've talked to someone. Payment doesn't guarantee recovery, and it can mark you as a repeat target.
The uncomfortable truth is that most small businesses recover, but slowly, and the ones that recover fastest are the ones who rehearsed before anything went wrong. A boring drill on a quiet Thursday beats a panicked scramble at 2 a.m.
So here's the question worth sitting with: if your screens locked this afternoon, would you know exactly which drive to reach for? If the answer is "I think so," that's your whole to-do list.
