When we hear about data breaches in the news, it’s usually the big names — major retailers, healthcare systems, government agencies. But for every headline-making breach, thousands of small business attacks go unreported. The victims don’t make the news, but their stories carry powerful lessons.
Here are three real-world scenarios (with details changed to protect the businesses involved) that show how small companies get hit — and what every business owner can learn from them.
Lesson 1: One Reused Password Took Down an Entire Practice
What Happened
A medical billing company with about 40 employees was running smoothly until one Monday morning when no one could access their files. Every workstation displayed a ransomware notice demanding $75,000 in Bitcoin.
The investigation revealed that the breach started weeks earlier. An employee had used their work email to sign up for a cooking recipe website. That website was later breached, and the employee’s credentials were posted on the dark web. Because they used the same password for their work email, the attacker walked right in.
From the email account, the attacker moved laterally through the network, eventually deploying ransomware across every connected device.
The Lesson
Password reuse is one of the most dangerous habits in business. A password manager and a strict policy against reusing credentials across personal and business accounts would have stopped this attack at the front door. Dark web monitoring would have flagged the compromised credentials before the attacker had a chance to use them.
Lesson 2: A Fake Invoice Cost a Construction Company $180,000
What Happened
A regional construction company received what appeared to be a routine invoice from a long-time subcontractor. The email came from the subcontractor’s email address (or so it seemed), referenced a real project, and included updated banking details with a note explaining they’d switched banks.
The accounts payable team processed the payment — $180,000 — to the new bank account. It wasn’t until the real subcontractor called asking about the overdue payment that anyone realized what had happened. The money was gone.
The attacker had compromised the subcontractor’s email account and had been monitoring the conversation between the two companies, waiting for the right moment to insert themselves with a fake invoice and updated payment details.
The Lesson
Any request to change payment information should trigger a verification call. Never update bank details based solely on an email — always call the vendor at a known phone number to confirm. This simple step would have saved this company $180,000. Additionally, email security that detects account compromise and flags suspicious behavior would have caught the intrusion much earlier.
Lesson 3: No Backup Meant Starting Over from Scratch
What Happened
A 60-person marketing agency used Microsoft 365 for everything — email, file storage, client presentations, and project management. They assumed Microsoft was backing everything up.
When a departing employee deleted their entire OneDrive and mailbox contents on their last day (whether malicious or accidental was never determined), the agency scrambled to recover the files. They discovered that Microsoft’s native retention had already expired for many of the older files. Client deliverables, project histories, and months of work were simply gone.
The agency spent weeks recreating files from scratch, reaching out to clients for copies of their own work, and dealing with the embarrassment of not having a backup for their own business data.
The Lesson
Cloud platforms are not backup solutions. Microsoft 365 and Google Workspace protect against their infrastructure failures, not your data management problems. An independent SaaS backup solution would have allowed the agency to restore every deleted file and email within hours, not weeks.
The Common Thread
All three of these scenarios share something in common: they were entirely preventable. Not with expensive, exotic technology — but with basic, proven security practices:
- Unique passwords and dark web monitoring
- Verification procedures for financial transactions
- Independent backup for cloud data
- Email security and monitoring
- Employee offboarding procedures that include account management
None of these are cutting-edge. All of them are available to small businesses at a reasonable cost. The difference between the businesses that get breached and the businesses that don’t usually isn’t budget — it’s preparation.
The Takeaway
You don’t have to learn these lessons the hard way. Take 30 minutes this week to ask yourself: Do we have unique passwords and MFA in place? Do we verify payment changes by phone? Is our cloud data independently backed up?
If the answer to any of those is “no” or “I’m not sure,” it’s time to act.
Want to make sure your business doesn’t become the next cautionary tale? Schedule a security review with us — we’ll show you exactly where you stand.