Table of Contents
A five-person marketing agency in Ohio came into the office one Monday and found every project file locked, replaced by a ransom note and a countdown clock. No warning. No phishing test that had failed the week before, no obvious crack in their setup — just a locked server and a decision to make in 72 hours.That story isn’t unusual anymore. It’s closer to routine. If you’ve found yourself wondering why small businesses are the number one ransomware target in 2026, the answer isn’t complicated: you’re easier to break into than a Fortune 500 company, and you’re still worth enough money to make it profitable.
Ransomware Attacks on Small Businesses: The Latest Numbers
Verizon’s 2026 Data Breach Investigations Report found ransomware present in 48% of all the breaches it analyzed this year, up from 44% the year before. Break that down by company size, and small and midsize businesses accounted for the vast majority of ransomware victims where the organization’s size was known — close to 96% in the dataset (Verizon 2026 DBIR). Large enterprises haven’t been spared — attackers are simply choosing where the resistance is thinnest.
The FBI’s Internet Crime Complaint Center backs that up. Ransomware complaints climbed to 3,611 in 2025, up from 3,156 the year before, and investigators are blunt about the fact that most incidents never get reported at all (FBI IC3 2025 Report). Total cybercrime losses tracked in that same report passed $20.8 billion — a 26% jump year over year.
Who’s Actually Behind These Attacks
Ransomware isn’t some vague cloud of risk — it’s specific, named criminal groups running it like a subscription business, complete with rented toolkits and chat-based “support” for negotiating with victims. Three names keep showing up in CISA advisories through 2026: LockBit, one of the most widely deployed ransomware operations in the world for several years running; Akira, which CISA’s own November 2025 advisory says is aimed mainly at small and medium-sized businesses, and has hit manufacturers, schools, and IT shops since 2023; and Play, a double-extortion crew that steals your data before locking it, active since 2022 and still drawing fresh CISA advisories as recently as last year.
None of these groups care who you are personally. They care whether your VPN is patched, whether MFA is turned on, and whether your backups actually work — which happen to be exactly the controls CISA tells every business, of any size, to put in place first.
For freelancers and small business owners looking to strengthen their overall security posture, our Freelancer Cybersecurity Guide covers essential topics such as password security, phishing awareness, device protection, backups, and safe remote work practices.
Why Attackers Picked You Over the Enterprise Down the Street
This isn’t personal. It’s a numbers game. A large company has a dedicated security team watching for unusual activity around the clock. Most small businesses have none of that. Research from StrongDM found that 47% of companies with fewer than 50 employees spend nothing at all on cybersecurity. Not “a little.” Nothing.Attackers don’t hand-pick targets the way a heist movie suggests. They scan the internet for unprotected remote-access tools, outdated software, and leaked passwords, then go after whatever turns up (Verizon 2025 DBIR). Extortion malware showed up in 88% of small-business breaches that year, against just 39% for large enterprises.
The Real Cost of a Ransomware Attacks on small businesses
Here’s something that surprises a lot of owners: ransom demands are actually falling. The median payment in this year’s DBIR was $139,875, down from $150,000 the year before, and 69% of victims now refuse to pay at all.The ransom was never the expensive part. Incident-response firm Huntress puts average downtime after an attack at 24 days — three-plus weeks where you can’t invoice, can’t take orders, can’t touch your own files. Sophos’s 2025 State of Ransomware survey found the average recovery cost for small companies with 100 to 250 employees runs about $638,536, and that’s before counting anything paid to the attacker. A CyberCatch survey of 1,200 U.S. small businesses found three-quarters could survive only three to seven days after an attack — nowhere close to that 24-day average
How It Actually Gets In
Forget the Hollywood version. Most ransomware on small businesses doesn’t start with some elite zero-day exploit. It starts smaller and dumber than that:
- Stolen or weak credentials. Verizon’s 2026 data shows 73% of ransomware victims had an infostealer infection or credential leak in the year before the attack — and half of those happened within just 95 days of the ransomware itself landing.
- Unpatched, internet-facing systems. VPN appliances and firewalls left unpatched are now one of the most common front doors.
- Exposed remote access. RDP left open without MFA is still a favorite.
- Third parties. Breaches involving a vendor or supplier jumped 60% this year and now show up in 48% of all incidents — your IT contractor’s weak password habits can become your problem.
- People. The human element shows up in 62% of breaches, and that mostly means one thing: phishing.
Training Is the Cheapest Defense You Have
Most ransomware incidents still trace back to a single click — one employee, one convincing email, one moment of “this looks legit.” Phishing is also getting harder to spot, partly because attackers are now using AI to write cleaner emails and scout targets faster, and partly because they’ve moved beyond email into texts and phone calls, which Verizon found succeed roughly 40% more often than email in simulated tests.
If you want to see how these campaigns actually get built — the spoofed domains, the urgency tricks, the pretexting — this breakdown of phishing techniques walks through it from the attacker’s side, which is genuinely one of the fastest ways to learn what to watch for. Pair that with quarterly phishing simulations and one simple rule — verify anything unusual by phone before acting on it — and you’ve closed the door attackers walk through most often, for close to nothing.
What To Actually Do This Week
None of this requires an enterprise budget. It requires showing up — and it lines up almost exactly with what CISA tells small businesses to do first in every #StopRansomware advisory it publishes.
- Turn on MFA everywhere — email, banking, remote access, cloud storage. This single step blocks most credential-based break-ins on its own.
- Back up properly. Follow the 3-2-1 rule, keep at least one copy offline or immutable, and actually test the restore. A backup nobody has tested is just a guess.
- Patch anything facing the internet. VPNs, firewalls, routers — these are now a top entry point, and patching them costs nothing but time.
- Close exposed RDP, or lock it behind MFA and a VPN.
- Run phishing simulations every quarter, even informal ones.
- Write a one-page incident response plan. Who you call, who gets notified, how you isolate an infected machine — figure it out before 2 a.m., not during.
- Audit vendor access. Limit what contractors and third-party tools can actually touch
- Look into cyber insurance, and read the exclusions before assuming you’re covered.
Related blog :how freelancers can protect their home office from ransomware attacks.
Author Bio
Canio Campaniello is an OSCP-certified penetration tester and founder of Hackita.it, an Italian-language resource on offensive security and ethical hacking