"We're too small to be a target."
It's the most common thing a small business owner says when the topic of ransomware comes up. It's also the belief that ransomware groups depend on. Because while small businesses are spending zero money on cyber security because they believe they're irrelevant, ransomware groups are spending enormous effort building automated tools to find and exploit exactly the organizations that believe they're irrelevant.
The data is unambiguous: 83% of ransomware victims are small businesses. Not banks. Not government departments. Not the multinational corporations that make the news. Small businesses — the bakery, the trades contractor, the law office, the property manager — are the primary target of the ransomware economy.
Why "Too Small to be a Target" Is Backwards
The logic of "too small to be a target" assumes that attackers prefer large targets. In most criminal contexts, that's true — why rob a corner store when you can rob a bank? But ransomware economics work differently.
Consider the comparison from an attacker's perspective:
Attacking a large enterprise: requires defeating a security operations centre, bypassing enterprise-grade endpoint detection, navigating a network monitored 24/7, and eventually extracting a ransom from an organization that has a dedicated incident response team and lawyers standing by. Success rate: low. Cost: high. Risk: significant (enterprise-level incidents draw law enforcement attention).
Attacking 100 small businesses: run an automated scanner looking for unpatched RDP and known vulnerabilities. For every 100 businesses scanned, a percentage will have exposed attack surfaces. Exploit them, deploy ransomware, collect $15,000–$50,000 each. Success rate: high. Cost: largely automated. Risk: minimal (small business incidents rarely draw law enforcement resources). Aggregate revenue: $1.5M–$5M from one scan campaign.
The math favours attacking small businesses at scale. And modern ransomware toolkits are built to enable exactly that — automated scanning, automated exploitation, automated ransom collection.
Ransomware groups operate like franchises. The platform operator builds and maintains the ransomware; affiliates pay to use it. Affiliates earn 70–80% of collected ransoms. The platform operator takes 20–30%. This creates a massive incentive structure where thousands of independent affiliates are scanning for vulnerable small businesses around the clock, competing to collect ransoms through the same platform.
The 16-Day Downtime Reality
The average downtime following a successful ransomware attack on a small business is 16 days. For a business billing $5,000 to $15,000 per day — not unusual for a trades company, a professional practice, or a property management firm — 16 days of downtime is $80,000 to $240,000 in lost revenue. Before accounting for recovery costs, ransom payments, and the clients who won't return after the disruption.
The 16-day figure doesn't represent 16 days of waiting for a decryption key. It represents 16 days of:
- Determining what happened and how (typically requires external forensics)
- Determining whether backups are clean and usable
- Rebuilding or restoring systems
- Reinstalling and reconfiguring software
- Verifying that the attacker no longer has access before reconnecting to clients and vendors
- Handling client communications, insurance claims, and (where applicable) regulatory notifications
If the business has clean, tested, off-network backups, recovery is faster. If they don't — and most small businesses don't — 16 days is optimistic.
The 60% Statistic That Gets Lost
60% of small businesses that suffer a ransomware attack close within six months. That figure comes from data compiled by multiple cybersecurity insurers and research firms, and it's worth sitting with for a moment.
It doesn't mean that 60% of businesses close because of the attack, in a direct cause-and-effect sense. What it means is that the combination of downtime, lost revenue, recovery costs, lost client trust, regulatory exposure, and the psychological toll of a major incident — layered on top of the already-thin margins typical of a small business — is often enough to be the final straw. Businesses that were already marginal don't survive it. Businesses that depend entirely on trust (legal firms, accounting practices, healthcare providers) sometimes can't rebuild that trust.
Approximately 65% of businesses that pay a ransom successfully recover all their files. The remaining 35% pay, receive a faulty decryptor, and still lose their data. Additionally, paying places you on a list of organizations willing to pay — which increases the likelihood of being targeted again, by the same group or by others who purchase those lists.
What the Attack Pattern Looks Like for a 10-Person Business
The typical small business ransomware incident follows a predictable path. A staff member receives a phishing email — or an attacker finds an open Remote Desktop port during an automated scan. The initial compromise happens. The attacker spends time inside the network, identifying what exists, where the backups are, and whether any of the data is valuable enough for double extortion (encrypting and threatening to publish).
On a weekend or holiday, the ransomware triggers. Every file the ransomware can reach — accounting software files, client documents, email archives, the database your scheduling software uses — gets encrypted. Monday morning, nobody can log in. A ransom note is on every screen.
The business owner calls IT. IT determines that the attack vector was an unpatched Windows server with RDP exposed to the internet. The backup drive plugged into the server was encrypted along with everything else. There is no clean backup. Options: pay the ransom and hope the decryptor works, or start from scratch.
This scenario plays out thousands of times per year in Canada. It plays out this way not because the business owners were careless or unsophisticated — it plays out this way because the standard default configuration of a small business IT environment (one server, one backup drive, RDP for remote access, no MFA) is exactly the configuration ransomware is designed to attack.
The Three Controls That Break This Pattern
The good news is that the attack pattern above is entirely preventable. Not with expensive enterprise tools — with three controls that are affordable for any small business:
Close RDP to the internet. Remote Desktop Protocol should never be exposed to the public internet. Use a VPN or a zero-trust access tool for remote work. RDP scanners run continuously, and an exposed RDP port is found within hours of being opened.
Multi-factor authentication on all accounts. MFA blocks the credential-based attack vectors — phishing, credential stuffing, brute force. If an attacker has a password but can't pass MFA, they can't get in. This is the highest-impact single control available.
Off-network, tested backups. A backup that's connected to your network gets encrypted when your network gets encrypted. An off-network backup — stored in a cloud service that your workstations can't directly write to, or on a drive that is disconnected except during scheduled backup windows — is the difference between a recoverable incident and a catastrophic one. And it must be tested: backups that have never been restored may not actually be recoverable.
The "too small to be a target" belief kills businesses. The truth is the opposite: small businesses are the preferred target, specifically because that belief leads to the undefended configurations that automated attack tools are built to exploit.