In 2019, staff at Arbor Dental in Longview, Washington, could not view their patients' X-rays. Ransomware had disrupted their computers and records, along with those of dozens of other dental practices in Washington and Oregon. The attack had reached them through their I.T. provider. ProPublica: Ransomware attacks on managed service providers
The clinic did not have to be the attacker's entry point to feel the fallout. A business may also be approached directly: a familiar name asks for gift cards, an invoice arrives with new payment details, or a text looks like a state filing reminder.
When the attack hits the provider
Arbor's provider handled software updates, firewalls, and backups. When an outside company runs those systems, the business still needs to know how it will work if they go down. Ask what is backed up, when recovery was last tested, who can access the backups, and how you will reach the provider if its own systems are unavailable. Keep those answers somewhere you can find them during an outage.
A Spokane manufacturer shut down overnight
In 2021, employees at Fluid Design Products arrived at work to find that their files had been encrypted. Owner Steve Scharff told KHQ that the ransomware attack shut down the Spokane manufacturer's operations. He had an off-site backup and did not pay the attackers, but it did not include everything stored on the desktop computers. KHQ: Spokane company temporarily shut down by ransomware
An off-site backup gave Scharff an option besides paying. The missing desktop files also show why a backup needs a restore test: check whether the orders, financial records, and files people use every day are actually there.
A $200 text sent across Washington
A Bellevue business owner received a text that looked like a state reminder to file an annual report. The owner paid $200 through the linked service, then learned that the company had filed the report with the state and paid the $60 state fee in effect at the time.
In 2023, the Washington Attorney General's Office reported that the companies involved had sent more than 147,000 deceptive texts to Washington businesses and nonprofits. More than 1,100 companies paid for the annual-report service. A court ordered the companies' websites shut down. Washington Attorney General: Court shuts down deceptive filing websites
$200 from one business may not make a national headline. Send the same message to thousands of owners and those payments add up. Check a filing notice through the state website you already know instead of the link in an unexpected text. The fees above describe this case, not necessarily today's filing cost.
A familiar name asking for a favor
At a small Philadelphia technology company, Sonia Nofziger received a message appearing to come from the company's new CEO. The sender asked for her phone number, then sent texts requesting gift cards for a charitable purpose. The person contacting her was an impostor. Nofziger lost $1,200. AARP: The “do me a favor” gift-card scam
The request appeared to come from someone with authority, and Nofziger was trying to help. Give people permission to call the person on a known number and verify a request, even when the message says the matter is urgent. If something feels wrong after they act, make it easy to report it immediately.
The vendor can be real and the payment details fake
In 2024, a Houston woman preparing to open a dog daycare had already made two payments to the construction company working on the building. The third invoice arrived on familiar-looking letterhead with a familiar signature. The email address was slightly different, and it came with new wire instructions. She transferred nearly $258,000 to an account that did not belong to the contractor. KPRC Houston: Dog-daycare owner loses money to invoice scam
The contractor and the work were real. The new bank details came from someone else. Before updating an account number or sending money somewhere new, call a known vendor contact using a number already on file, not the number in the message asking for the change.
Start with what your business does today
Before deciding what to protect, find out what your business actually uses and how the work gets done. Which systems and accounts do you have? Who uses them? How do people pay bills, send invoices, and report problems? What happens when someone notices something unusual?
Talk to the people doing the work. Billing may have moved to a new process while an old one is still written into a procedure or assigned to a system nobody uses. Without asking, you could spend weeks protecting the wrong process while missing the one that matters today.
Once you know what the business relies on, you can decide where to start:
- Protect the accounts that matter. Require multifactor authentication for email, financial systems, and administrative accounts. Know how you will recover access when the usual person is unavailable.
- Practice recovery. Back up the information the business needs, keep a copy protected from routine access, and test restoring it. A backup is useful when you can actually get the business working again.
- Verify changes involving money. Call a known contact before changing payment details or acting on an unexpected request for funds or gift cards.
- Give people a way to report concerns. Make it safe to speak up. Thank the person who reports a suspicious message and tell them what happened next.
- Know who owns the decision. Ask what your I.T. provider handles, what the business is responsible for, and who will coordinate when something goes wrong.
No business is too small. A single redirected payment, stolen account, or inaccessible file can affect the people counting on it.
Praeven helps organizations understand what an attacker can use and prepare the people responsible for responding.