"We got a guy. Don't need you guys. You're too expensive."

That was the verdict, according to a story published October 8 in The Register, when a brand-new CFO at a small construction company called a security firm and asked to bring them in. The CFO saw the risk. The owner saw the invoice. He already had a one-person IT arrangement, and his business was too small for hackers to bother with anyway.

Three weeks later, ransomware had encrypted the company's old, unpatched Windows server: the machine that held everything the business needed to operate. Their one backup was an external drive plugged into that same server, so the ransomware swept it up along with everything else. Payroll stopped. The books were gone, so they couldn't even say who owed them money. The consultant who took the call for help that day, Dave Hatter of Intrust IT, recognized the name. It was the same company that had declined his services weeks earlier. A firm that had operated for years was out of business within months.

The consultant never learned whether they paid the ransom. It wouldn't have mattered much either way.

Nobody had to hack anything

Read the details of that story and notice what is missing: an elaborate intrusion, an exotic exploit, a targeted campaign. What actually killed this business were two ordinary, findable problems.

One: a server running old, unpatched software. Attack tools are built to try known openings at scale. An unpatched machine isn't a target someone chose; it's an invitation everyone can accept.

Two: a backup that lived in the blast radius. An external drive connected to the server it's protecting is not a backup you can depend on. Anything that reaches the server reaches the drive. When both copies vanish at the same moment, "we have backups" was only ever a sentence, not a plan.

Most ransomware is not a genius at work. It's automation looking for the front doors a business left open. You don't have to be worth attacking. You just have to be reachable.

The comparison hiding in the same story

The same consultant, in the same published piece, tells a second story. Another pair of companies in landscaping and construction: an executive's email account gets compromised, and the attacker uses it to send polished, believable messages to a second company, posing as a routine request for proposal. The message was clean, the sender was real, and the link led to a login page that looked exactly like a Microsoft 365 sign-in. The victim entered their password, entered their approval code, and handed the attacker their session. What saved them was suspicious-login monitoring that caught the anomaly within minutes and kicked the attacker out.

Two companies. Same consultant, same week, same industry family. One is gone. One survived a live intrusion without losing a day. The difference between them wasn't budget. It was setup: one had a second person's eyes on the machinery, the other had a drive daisy-chained to the thing it was supposed to be protecting.

"The big ones are targets, we're too small" is an argument about attacker attention. But ransomware doesn't hire analysts and pick. It scans, finds openings, and takes them, and the openings don't care about your headcount.

What would have changed the ending

Nothing in the fix list is exotic. That's the part worth sitting with.

  • Patching. The server in this story ran outdated software. Updates are the cheapest risk reduction available, and skipping them isn't a strategy, it's a date with a reminder.
  • Backups that live somewhere else. A copy of your data has to be off the machine it's protecting, and ideally off the premises. The backup that sits next to the server is like the second key taped inside the lockbox it's guarding.
  • A second set of eyes. The CFO in this story tried to buy exactly this and got vetoed. Someone outside the business, who looks at it regularly, is the reason the second company found its intruder in minutes instead of months.

Every one of those costs less than one unrecoverable week.

The bottom line

For years, "we've got a guy" was a reasonable answer, and the business survived anyway. Then a routine scan found an unpatched door, and everything behind it: payroll, receivables, the jobs in progress. There was no dramatic hack in this story, only ordinary openings and one decision made to save money. Patching and real backups would have rewritten the ending, and the help to get it done was offered and declined.

If you don't know when your systems were last patched, or where your backups live, or whether anyone has actually tried restoring one, that's not an accusation. It's a question worth answering on purpose, with someone who does this for a living.

Story: The Register, October 8, 2026, as told by Dave Hatter of Intrust IT.