Key Takeaways

  • Small businesses are disproportionately targeted by ransomware – and most lack the defenses to stop it.
  • Paying the ransom is rarely a solution; 69% of businesses that paid were attacked again.
  • A layered defense — combining solid backups, employee training, MFA, and an incident response plan — is the most effective way to prevent ransomware attacks.
  • Free resources, such as real phishing examples from the Hudson Valley, can help sharpen your team’s ability to spot threats before they cause damage.
  • Recovery costs average $1.53 million, but most of those costs are preventable with the right preparation in place today.

Small Businesses Are Ransomware’s Favorite Target

Ransomware doesn’t just go after hospitals and Fortune 500 companies. Small businesses are increasingly the preferred target. According to the Verizon Data Breach Investigations Report, 88% of SMB data breaches in 2025 involved ransomware — more than double the rate seen at larger organizations. Attackers know that small businesses often run lean IT teams, use outdated software, and skip security tools that seem out of budget.

The financial reality is severe. The average cost of recovering from a ransomware attack reaches $1.53 million – and that figure doesn’t even include the ransom itself. Roughly 60% of small businesses close within six months of a serious cyberattack — a reminder that this isn’t a problem that only affects hospitals or enterprise companies.

According to Hudson Valley experts from Fisch Solutions, understanding how these attacks occur and what stops them is the most actionable step a small business owner or IT manager can take right now. Real phishing examples from Hudson Valley businesses — the kind convincing enough to fool employees every day — offer a fast way to understand what’s actually being used against small businesses right now.

Why Paying the Ransom Isn’t the Answer

When files are locked and operations are grinding to a halt, a ransom payment can feel like the fastest path back to normal. It rarely is. Research indicates that roughly 53% of victims who paid the ransom either couldn’t recover their data or received corrupted files. Worse, 69% of businesses that paid were attacked again – often by the same group, who now know the business will pay.

Beyond the low odds of a clean resolution, paying funds criminal organizations and may create legal exposure depending on who the attacker is. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has issued warnings about payments made to sanctioned ransomware groups. The far better investment is in prevention and recovery readiness – so payment is never on the table.

Back Up Your Data Before You Need It

A reliable backup strategy is the single most important technical safeguard against ransomware. If attackers encrypt your files, a clean and recent backup means recovery without negotiation. Without one, the choice becomes paying or rebuilding from scratch.

From 3-2-1 to 3-2-1-1-0: Why the Classic Rule Needed an Upgrade

The classic 3-2-1 backup rule has been standard practice for years: keep three copies of data, stored on two different media types, with one copy stored offsite. That’s still a solid foundation – but ransomware has evolved to specifically target and encrypt connected backup systems. The updated 3-2-1-1-0 rule adds two critical layers:

  • 1 offline or air-gapped copy – completely disconnected from any network
  • 0 errors – meaning backups are verified and tested regularly, not just assumed to be working

CISA recommends frequent, encrypted, and offline backups as a baseline expectation – not an advanced practice.

Offline and Air-Gapped Copies

An air-gapped backup is physically isolated – no network connection, no cloud sync, no path for malware to reach it. Consider a scenario where ransomware hits a small business’s systems: if air-gapped backups are intact and the containment response is disciplined, recovery over a single weekend without paying a cent is entirely achievable. Contrast that with the Toronto Public Library System, which faced weeks of operational paralysis after a ransomware attack in October 2023 – their backups were inadequate, and recovery dragged on far longer than it should have.

Your Employees Are the First Line of Defense

Technology alone can’t stop ransomware when a person opens the door. Human error accounts for 88% of data breaches. That statistic isn’t an indictment of employees – it’s an argument for investing in them.

Phishing: The Most Common Entry Point

Phishing emails – messages designed to look like they come from a trusted source – are the most common delivery method for ransomware. They arrive disguised as vendor invoices, shipping notifications, IT alerts, or even messages from a colleague. A single click on a malicious link or attachment can trigger an infection that spreads across an entire network within hours.

What Effective Training Looks Like

One-time security awareness sessions don’t move the needle. Effective training is ongoing, specific, and interactive. The most impactful programs include:

  • Simulated phishing campaigns – sending realistic but fake phishing emails to employees and tracking who clicks
  • Immediate feedback loops – when an employee fails a simulation, showing them exactly why that email was suspicious
  • Regular refreshers – threat tactics change, and training should keep pace
  • Clear reporting procedures – employees should know exactly who to contact and how if they suspect a phishing attempt

The goal isn’t to catch employees making mistakes – it’s to build instincts that make phishing attempts obvious before anyone clicks.

Close the Doors Attackers Use Most

Ransomware attackers follow the path of least resistance. Three technical controls dramatically reduce the available attack surface for most small businesses.

Multi-Factor Authentication (MFA)

MFA requires a second form of verification – a code sent to a phone, a biometric scan, an authenticator app – beyond just a password. It blocks 99.9% of automated account attacks, according to Microsoft. Yet 65% of small businesses still don’t use it. Enabling MFA on email accounts, remote access tools, and cloud services is one of the highest-impact, lowest-cost changes any business can make today.

Endpoint Detection and Response (EDR)

Traditional antivirus software recognizes known threats. EDR solutions go further – they monitor device behavior in real time, flag anomalies, and can automatically isolate a compromised device before ransomware spreads laterally through the network. For small businesses without a dedicated security operations center, EDR provides a layer of automated vigilance that traditional tools simply can’t match.

Patching and Access Controls

Unpatched software is one of the most commonly exploited entry points in ransomware attacks. Keeping operating systems, applications, and firmware up to date closes known vulnerabilities before attackers can exploit them. Equally important is the principle of least privilege: employees should only have access to the data and systems they actually need for their role. Limiting access limits the blast radius if an account is compromised.

Have a Plan Before an Attack Happens

No defense is perfect. A business that has thought through its response before an attack hits will always recover faster – and with less damage – than one making decisions in the middle of a crisis.

What an Incident Response Plan Covers

CISA recommends that every organization, regardless of size, develop and regularly test an incident response plan. At minimum, that plan should address:

  • Containment steps – how to isolate infected systems quickly to stop lateral spread
  • Communication protocols – who inside and outside the organization needs to be notified, and when
  • Backup restoration procedures – step-by-step instructions for restoring from clean backups
  • Roles and responsibilities – who owns each step, especially if key staff are unavailable
  • Law enforcement and legal contacts – including the FBI’s Internet Crime Complaint Center (IC3) and legal counsel familiar with breach notification requirements

The plan only works if people know it exists. Running a tabletop exercise – a structured walkthrough of a simulated attack – once or twice a year turns the plan from a document into a practiced response.

Preparation Today Beats Recovery Tomorrow

Ransomware attacks on small businesses aren’t a matter of if – industry data increasingly makes that clear. The gap between businesses that survive these incidents and those that don’t almost always comes down to preparation: backups that actually work, employees who recognize phishing, authentication controls that block unauthorized access, and a response plan that’s already been rehearsed.

None of these measures require an enterprise budget. They require prioritization and follow-through – and starting sooner rather than later. Every week without MFA enabled, every employee who hasn’t seen a simulated phishing email, and every backup that hasn’t been tested is a window attackers are happy to use.

For small businesses in the Hudson Valley looking for hands-on guidance, working with a local cybersecurity partner that understands the specific threat landscape can make the difference between a close call and a prolonged shutdown.

Fisch Solutions

3188 Route 9W
Suite 1
New Windsor
New York
12553
United States

About The Author
NewsNetwork