Healthcare, Manufacturing, Legal Data: March’s Attack Wave Confirms No Industry Is Off the Target List

March 17, 2026

by James with No Comment Featured Cybersecurity

March 2026 delivered a cross-industry attack pattern that security researchers are calling the most volatile month of the year so far: medical technology, legal data, higher education, and manufacturing each absorbed significant incidents, driven by a combination of ransomware operators seeking high-value data and geopolitically-motivated groups targeting U.S. and allied infrastructure. The breadth of this month’s incidents is itself a data point that business leaders should act on.

Stryker, LexisNexis, and the Strategic Targeting of Data-Rich Organizations

Stryker Corporation, one of the world’s largest medical technology companies, reported a significant cyberattack in March attributed to an Iran-aligned hacktivist group. The attack disrupted administrative and operational systems at multiple business units. Stryker’s products and services reach hospitals, surgical centers, and medical providers across dozens of countries — the downstream impact of any sustained operational disruption extends well beyond the company itself.

LexisNexis, the legal and professional services data platform used by law firms, financial institutions, and compliance teams worldwide, also experienced an incident in March affecting portions of its data infrastructure. The nature of the data LexisNexis manages — legal records, professional credentials, financial due diligence files, court documents — makes it a high-value target for both nation-state actors seeking intelligence and criminal operators building identity fraud capabilities. The incident is under investigation.

Both incidents share a characteristic that defines the March 2026 threat environment: attackers are targeting organizations for their data value, not their revenue size. Stryker’s medical data and LexisNexis’s legal records have intelligence value far exceeding any ransom that could be extracted. The strategic motivation behind these attacks extends beyond financial extortion to information collection — a pattern that security agencies in the U.S., U.K., and EU have all flagged as an accelerating concern in 2026.

Manufacturing worker checking connected digital control panel on factory floor

Higher Education and Manufacturing: Sectors That Underestimate Their Exposure

The University of Hawaii and several peer institutions experienced ransomware incidents in March, continuing a pattern from 2025 that saw education sector attacks increase 70 percent year-over-year. Universities hold a specific combination of data that makes them attractive targets: personal information on hundreds of thousands of students and alumni, research data with potential commercial or strategic value, financial records, and healthcare information from campus medical services. They also typically operate with fragmented IT environments and limited security staffing relative to their attack surface.

Michelin, the global tire and automotive manufacturing company, also reported a March incident, reinforcing that manufacturing sector organizations are increasingly targeted for operational disruption and intellectual property theft simultaneously. Manufacturing facilities that have integrated operational technology — connected machinery, automated production systems, supply chain software — with traditional IT networks face a particular risk: ransomware that crosses from the IT environment into operational systems can halt physical production, not just digital operations.

For small and mid-size businesses in manufacturing, healthcare services, professional services, or education-adjacent industries, March’s headlines carry a direct message: your sector is not off the target list. The incidents at Stryker, LexisNexis, and university systems involved attackers who had specifically researched these organizations’ data holdings and systems before executing their attacks. Opportunistic attacks are still common, but targeted attacks — where attackers invest weeks or months in reconnaissance before executing — are increasing in frequency.

Supply Chain and OAuth Abuse: The Technical Pattern Behind March’s Incidents

April will bring news of the March incidents’ downstream effects, as is typical of the months following major attacks. What the March data already shows is a technical pattern worth understanding: OAuth abuse and supply chain compromises are responsible for a disproportionate share of the month’s incidents. OAuth is the authentication framework that allows one application to access another on a user’s behalf — the mechanism behind “Sign in with Google” or “Connect your Slack account.”

When attackers compromise an OAuth token or abuse OAuth permissions in a connected application, they gain access to everything that token is authorized to reach — often across multiple systems simultaneously, without triggering traditional login-based detection. The proliferation of connected business applications has expanded the OAuth attack surface significantly: the average SMB now uses more than 80 cloud applications, many of which are interconnected through OAuth relationships that have never been audited.

The practical implication for business owners is that connected app permissions represent an unreviewed attack surface in most small business environments. Applications granted access to your Google Workspace, Microsoft 365, or financial systems years ago may still hold permissions that are no longer necessary. An attacker who gains access to one connected application inherits whatever access that application holds across your environment.

What Business Leaders Should Consider

Audit your connected application permissions this month. In Google Workspace, go to Security → API Controls → Third-party apps. In Microsoft 365, go to the Azure Active Directory portal → Enterprise Applications. Review what applications have been granted access, what permissions they hold, and whether those applications are still in active use. Revoke permissions for any application your organization no longer uses.
If you work in healthcare, legal, or professional services, treat your data as a strategic intelligence target, not just a compliance requirement. The March incidents demonstrate that data-rich organizations are targeted not just for ransom but for the intelligence value of the information they hold. Your response plan should account for both data theft and operational disruption scenarios.
Ask your IT provider about network segmentation if you have any connected operational equipment. Manufacturing, healthcare, and facilities management businesses that have connected physical equipment — machinery, HVAC, security systems, medical devices — to their business network need to confirm that a compromise of the IT network cannot reach operational systems. Network segmentation is the primary technical control for this risk.
Verify that your cyber insurance covers geopolitically-motivated attacks. Some cyber policies include exclusions for nation-state or politically-motivated attacks. The Iran-aligned group behind the Stryker attack places that incident in a potentially excluded category for some policy holders. Review your exclusions now.
Run a phishing simulation with your team in Q2. The reconnaissance-heavy, targeted attacks documented in March begin with social engineering — attackers gather information about your organization and craft highly personalized communications that are difficult to distinguish from legitimate business correspondence. A quarterly phishing simulation, even a simple one, trains your team to pause before clicking and report suspicious messages.

A Breach Doesn’t End When the Systems Come Back Online: How Business Leaders Protect and Rebuild Customer Trust

February 19, 2026

by James with No Comment Featured Cybersecurity

When a business experiences a data breach, the technology team’s job ends when systems are restored and the vulnerability is patched. The business leader’s job has just started. Reputation damage from a breach follows a different timeline than technical damage — it accumulates over months, plays out in customer behavior, and takes years to fully resolve. The businesses that manage it successfully treat it as a business problem, not a communications problem.

What the Research Shows About Breach-Related Customer Behavior

The financial impact of a breach extends far beyond the immediate recovery costs. IBM’s 2025 Cost of a Data Breach Report identifies customer churn — the loss of existing clients following a breach — as one of the three largest cost components for most organizations, alongside data restoration and regulatory response. Customer churn from a breach event is not immediate. It builds over time as affected customers make decisions about where to take their business.

Research from the Ponemon Institute found that businesses in regulated industries — healthcare, financial services, legal — experience the highest customer churn following a breach, with some sectors losing upwards of six percent of their customer base in the 18 months following a significant incident. For a business generating $2 million in annual revenue, a six percent customer loss represents $120,000 in recurring annual revenue — an ongoing cost that doesn’t appear in the initial breach report but compounds over the following years.

Consumer sentiment research from 2025 reveals a more nuanced picture: customers respond differently to breaches based on how the business communicated. Organizations that notified quickly, explained what happened in plain language, and provided specific protective actions for affected customers experienced measurably lower churn than those that delayed notification, minimized the incident, or communicated in technical language that customers couldn’t act on. The breach itself was less predictive of churn than the response to it.

Customer service professional communicating reassuringly on phone

The Three-Phase Reputation Recovery Framework

Phase 1: Immediate Response (Days 0-14). The actions taken in the first two weeks after a breach are disproportionately influential on long-term reputation outcomes. Speed of notification, clarity of communication, and the tone of the first public statement set the frame through which all subsequent events are interpreted. Businesses that notify affected customers before the breach is publicly reported, communicate in plain language rather than legal boilerplate, and take visible immediate action — credit monitoring offers, account security resets, direct customer calls for high-value relationships — demonstrate that they prioritize their customers over their own exposure management.

Phase 2: Stabilization (Weeks 2-12). The stabilization phase is when reputation capital is either built or destroyed through consistent follow-through. Businesses that communicated clearly in week one and then went silent while waiting for legal or regulatory processes to complete typically experience worse outcomes than those that provided regular, substantive updates throughout the investigation. Monthly updates — even when there is nothing definitive to report — signal continued ownership of the situation. Silence signals the opposite.

Phase 3: Recovery and Differentiation (Months 3-24). The businesses that successfully recover reputation capital do so by treating the breach not as a past incident to move beyond but as a catalyst for visible security investment. Publicly committing to and completing a SOC 2 audit, publishing the results of a third-party security assessment, or announcing a formal security governance program positions the organization as having responded substantively rather than defensively. Customers who stayed through the incident reward this behavior with increased loyalty; prospective customers evaluate it as evidence of organizational maturity.

What Separates Businesses That Recover from Those That Don’t

The common thread across organizations that successfully navigate breach-related reputation damage is that they treat reputation management as a leadership responsibility, not a communications function. The CEO or owner who is visibly accountable — who signs the customer notification letter, who appears in the public statement, who is reachable to key client contacts — signals something fundamentally different than the organization that routes all breach communication through a PR firm and legal counsel.

Business owners sometimes resist this approach out of concern that visibility increases personal liability. The evidence does not support that concern. Customers, regulators, and courts consistently treat visible, authentic accountability more favorably than organizational deflection. The business leader who steps forward is more likely to preserve trust — and legal standing — than the one who steps back.

What Business Leaders Should Do Next

Draft your breach notification letter before you need it. Write a template that explains what happened, what data was affected, what you are doing about it, and what affected customers should do to protect themselves. Remove all legal hedging language and technical terminology. Have legal review it for compliance, not for tone. Store it somewhere accessible that isn’t your main network.
Identify the ten customers or relationships whose loss would be most damaging to your business. For a breach event, these are your highest-priority personal outreach targets. Know in advance who they are, who the right contact person is, and what direct channel you would use to reach them within 24 hours of discovering a breach.
Evaluate credit monitoring or identity protection services as a standard breach response offering. Offering affected customers credit monitoring at your cost demonstrates accountability and is often expected by regulators. Identify the service you would use now so you’re not evaluating vendors during a crisis.
Define your organization’s breach communication values in writing. Speed, transparency, and plain language are the three values that research consistently links to better reputation outcomes. Write a one-paragraph statement of how your organization commits to communicating during a security incident. Include it in your incident response plan.
Ask your IT provider to prepare a one-page “breach facts” template. When a breach occurs, you need to communicate quickly with a clear understanding of what happened technically. Your IT provider should be able to produce a plain-language description of the incident type, the affected systems, and the corrective actions taken within 24 hours of containment. Request this deliverable as part of your current IT service agreement.

Supply Chain Attacks Are Now the Preferred Method: How One Vendor Breach Can Shut Down Dozens of Businesses

February 10, 2026

by James with No Comment Featured Cybersecurity

Security researchers have documented a decisive strategic shift in how ransomware operators select targets: attacks through shared vendors and software providers — what the industry calls supply chain attacks — are now the preferred method for maximizing impact from a single compromise. For small business owners who depend on third-party software, payment processors, IT providers, and cloud platforms, this changes the calculus of risk in ways that demand a direct response.

The Economics of Supply Chain Attacks

The Conduent breach, which was initially reported as affecting approximately 4 million individuals, grew to confirmed impact on over 25 million people by February as Texas and Oregon completed audits of affected residents. The final scope of the Conduent incident is not yet known. What is known is that Conduent was one vendor, one breach event, and the downstream impact reached government agencies, healthcare organizations, and businesses across multiple states — none of which had any visibility into the vulnerability that created the exposure.

This is the model that attackers have recognized as superior to direct targeting of individual organizations. A single compromise of a widely-used vendor delivers more victims, more leverage, and more monetization opportunities than any equivalent effort spent targeting small businesses one at a time. Ransomware-as-a-Service operators have adapted their targeting criteria accordingly: the highest-value targets are no longer the largest organizations — they are the organizations that serve the most other organizations.

The Conduent case illustrates a specific pattern: the breach was initially contained in the public disclosure, then expanded significantly as downstream organizations completed their own audits. This is typical of supply chain incidents. The vendor’s initial breach notification understates impact because they don’t have full visibility into what their clients held. The full scope emerges over weeks and months, long after affected organizations have already made their initial response decisions.

Aerial view of interconnected shipping containers representing supply chain

Three Supply Chain Incidents Business Owners Should Know

The pattern isn’t limited to large payment processors. In December 2025, SoundCloud, Freedom Mobile, and Leroy Merlin each reported breaches that originated with shared infrastructure or third-party providers rather than direct attacks on their own systems. In January 2026, both BridgePay’s ransomware event and the Match Group ShinyHunters claim followed similar pathways: attackers accessed platforms that served many organizations simultaneously.

For small business owners, the implications are practical rather than theoretical. If you use a managed payroll service, a cloud accounting platform, a point-of-sale system provided by a third-party vendor, or any business application that your provider hosts on shared infrastructure, you are embedded in a supply chain that attackers are actively analyzing for vulnerability. The question is not whether your vendor will be attacked. The question is whether you have the contractual protections, the monitoring, and the response plan to manage the event when it happens.

The FCC’s January 29th warning about a fourfold increase in attacks targeting SMB providers reinforced what incident data has been showing for months: the small and mid-size businesses that serve other small and mid-size businesses — IT providers, managed services firms, telecommunications companies, regional software vendors — have become primary targets precisely because of their role in the supply chain. An attacker who compromises a managed IT provider gains access to every client organization that provider manages.

What This Means for How You Evaluate Vendor Risk

Most small business owners evaluate vendors on price, service quality, and reliability. Security posture is rarely in the evaluation criteria, and almost never contractually enforced. This represents a measurable gap between the current threat environment and most businesses’ vendor management practices.

The businesses that are managing supply chain risk effectively are not doing so through sophisticated technical audits — they’re doing it through contractual requirements and basic due diligence questions. Does the vendor carry cyber liability insurance? Have they completed a SOC 2 Type II audit in the last 12 months? What is their notification obligation to clients if they discover a breach? How quickly can they demonstrate that they can restore your data from their backup systems?

These questions take 15 minutes to ask and cost nothing to require answers to. Vendors who cannot answer them should be evaluated as uninsured supply chain risk in your business continuity planning.

What Business Leaders Should Consider

Add four supply chain security questions to your vendor evaluation process. For any vendor who holds your data or serves as infrastructure for your operations, ask: (1) Do you carry cyber liability insurance? (2) Have you completed a SOC 2 Type II audit? (3) What is your breach notification timeline to clients? (4) Can you demonstrate a successful data restore from backup? Document the answers.
Review your contracts for vendor breach notification clauses. If your existing vendor contracts don’t require breach notification within 72 hours, add that language at next renewal. Most reputable vendors will accept this provision. Those who won’t are signaling something about how they handle incident communication.
Know what data each vendor holds and where it lives. Create a simple inventory: vendor name, what data they hold (customer records, financial data, employee information), and whether that data is encrypted at rest. This takes one hour and becomes foundational when you need to assess impact in a breach event.
Confirm your cyber insurance covers supply chain incidents. Many standard cyber policies exclude or limit coverage for breaches that originate with a vendor rather than your own systems. Review your policy specifically for supply chain and third-party breach coverage and request a coverage opinion from your broker on this specific scenario.
Establish an alternative vendor capability for your two most critical dependencies. For each vendor whose failure would halt your operations, identify a backup option. You don’t need to contract with the backup vendor. You need to know who they are, what their onboarding timeline is, and what data migration looks like. That knowledge is valuable before an emergency, not during one.

Why 1 in 5 Small Businesses Don’t Recover From a Cyberattack — And the Five Controls That Determine Which Side You’re On

January 22, 2026

by James with No Comment Featured Cybersecurity

A 2025 Mastercard survey of more than 5,000 small business owners found that one in five businesses that experienced a cyberattack went bankrupt or permanently closed. The 80 percent who survived shared something in common: they had either prepared for the attack’s aftermath before it happened, or they absorbed costs that most businesses could not. The difference between those two outcomes is measurable, predictable, and largely within your control.

What the Survival Gap Actually Looks Like

The 20 percent failure rate among attacked small businesses is not evenly distributed. Businesses that fail after a cyberattack share identifiable characteristics: they were operating without tested backups, they had no documented recovery procedures, and they discovered their cyber insurance either didn’t cover the specific incident type or had coverage limits that didn’t match actual recovery costs. The attack itself was often not the cause of closure. The absence of preparation was.

IBM’s 2025 Cost of a Data Breach Report calculates that the average ransomware incident costs $4.4 million in total — over 38 times the average ransom demand of $115,000. That multiplier matters: businesses that pay the ransom and assume they’re recovered are typically looking at a fraction of their total costs. The remaining $4.2 million comes from operational downtime, data restoration, legal fees, regulatory penalties, customer notification obligations, and the staff time consumed by the response and recovery process.

Sixty percent of businesses hit by a major cyberattack close within six months. The timeline matters because most of the costs don’t arrive immediately. Customer churn happens over weeks. Regulatory investigations happen over months. Litigation from affected parties may not resolve for years. A business that appears to have survived an attack in the first 30 days may still be absorbing damage that manifests as closure by month six.

Contrast between active thriving office and empty closed business office

The Five Controls That Separate Survivors from Non-Survivors

Control 1: Offline, encrypted, tested backups. The most consistent differentiator between businesses that recovered and those that didn’t was backup integrity. Organizations with offline backups — stored separately from the network that ransomware could encrypt — and that had confirmed those backups were restorable within the past 90 days, recovered in days. Those whose backups were connected to the same network, unencrypted, or untested discovered their safety net didn’t exist when they needed it most.

Control 2: Multi-factor authentication on all remote access systems. Twenty-three percent of 2025 attacks entered through compromised credentials. Every system that can be accessed remotely — email, VPN, remote desktop, cloud applications — should require a second factor beyond a password. This single control eliminates the vast majority of credential-based attacks, including those using passwords obtained from prior third-party breaches your employees may not know occurred.

Control 3: A documented incident response plan. Businesses that had a documented response plan — even a simple one — recovered faster and at lower cost than those improvising their response under pressure. The plan does not need to be sophisticated. It needs to answer four questions: who do we call first, what systems do we isolate, how do we communicate with customers and employees, and what is our recovery priority order? Write those answers down before you need them.

Control 4: Cyber liability insurance with coverage limits that reflect actual costs. Coverage limits set based on the perceived value of what’s being protected — the server, the software — rather than the full scope of incident costs routinely leave businesses underinsured. A business with $500,000 in annual revenue might carry $250,000 in cyber coverage and face $1.8 million in recovery costs. Work with your broker to calculate coverage based on your actual recovery scenario, not on asset replacement value.

Control 5: Regular patching of all business-critical software. Thirty-two percent of 2025 attacks exploited unpatched vulnerabilities. Monthly patching of operating systems, business applications, and network devices eliminates the most actively exploited known vulnerabilities from your environment. This control requires consistent execution over time, not sophisticated tools.

What Businesses That Survive Have in Common

The businesses that absorb a cyberattack and continue operating are not necessarily the ones with the best technology. They are frequently the ones with the best operational discipline. They patched consistently, so fewer exploitable vulnerabilities existed. They maintained offline backups, so ransomware encryption wasn’t terminal. They had insurance that reflected their actual risk, so the financial event was survivable. They had a response plan, so the first 72 hours were methodical rather than chaotic.

This is an operational discipline problem, not a technology problem. The tools required are available to every small business. The difference between the businesses in the 80 percent who survived and the 20 percent who didn’t is almost never the sophistication of their defenses. It is whether they had executed the fundamentals consistently before the attack arrived.

What Business Leaders Should Do Next

Schedule a backup restoration test for this month. Call your IT provider or whoever manages your backups and ask them to demonstrate a successful file restore from backup. If they can’t do it on short notice, that’s the answer. Fix the backup situation before anything else.
Enable MFA on every email account in your organization. Email is the most frequently compromised business system and the entry point for a significant percentage of phishing-based attacks. If your team is not using MFA on email, make that change this week.
Write a one-page incident response cheat sheet. List the first three calls you make if you discover ransomware on your network: your IT provider, your cyber insurance carrier, and your legal counsel. Include the after-hours contact numbers. Put copies in three places — because when ransomware hits, the computers where this document lives may be inaccessible.
Review your cyber insurance policy with your broker this quarter. Ask specifically: does my current coverage limit match a realistic full recovery cost scenario? Does the policy cover business interruption, customer notification costs, and regulatory defense in addition to data recovery?
Confirm your software patching schedule is actually happening. Ask your IT provider for the date of the last patching cycle for your critical systems. If you don’t have an IT provider, set a monthly calendar reminder to run Windows Update and update your business software on the first Tuesday of each month.

A Payment Processor Goes Dark, 26 Million Records Exposed: January’s Cyberattack Roundup and What Business Owners Must Know

January 13, 2026

by James with No Comment Featured Cybersecurity

The first two weeks of 2026 have produced three incidents that underscore a theme: attackers are targeting the financial and communications infrastructure that businesses depend on, not just the businesses themselves. For small and mid-size business owners, the implication is direct — your cyber risk does not stop at your front door.

Conduent: When the Breach Your Vendor Hid Becomes Your Problem

Conduent, a business process outsourcing firm that handles payment services for government agencies and corporations across the United States, disclosed a breach initially estimated at approximately 4 million affected individuals. By late January, Texas state officials reported that 15.4 million Texas residents were affected. Oregon officials followed with 10.5 million. The total confirmed breach now exceeds 25.9 million individuals — and that number may continue to grow as more agency audits are completed.

Conduent processes payments on behalf of government agencies, healthcare organizations, and corporations. The data exposed includes names, Social Security numbers, financial account details, and personal identifiers. Critically, many of the affected individuals never had a direct relationship with Conduent — they had a relationship with an agency or employer that contracted Conduent to process their information. This is the nature of third-party breach exposure: end users bear the consequences of decisions made by organizations they’ve never interacted with.

For business owners, the Conduent breach illustrates a specific vulnerability: when you outsource a business function, you are not outsourcing the associated risk. If a vendor who processes your payroll, manages your benefits, or handles customer payments is breached, you bear responsibility for the notification, the remediation, and the reputational impact — even if the technical failure was entirely on your vendor’s side.

Financial services office with professionals reviewing system errors

BridgePay and Match Group: Payment Platforms and Consumer Data Under Pressure

BridgePay, a payments platform serving government clients and municipal organizations, confirmed a ransomware attack that disrupted service and locked multiple city governments out of critical payment systems. The incident forced manual processing of transactions across affected municipalities and highlighted the cascading operational impact when infrastructure-level services experience ransomware events.

Meanwhile, the ShinyHunters ransomware and extortion group — the same group responsible for the McGraw-Hill Salesforce breach that dominated headlines last fall — claimed theft of more than 10 million records from Match Group, the parent company of Hinge, Match, and OkCupid. The claim, posted January 28th, has not been fully confirmed by Match Group, but the pattern is consistent: ShinyHunters has transitioned from opportunistic attacks to sustained campaigns targeting large platform operators with extensive user data. Their goal is not just ransom — it’s a data marketplace where stolen records fund future operations.

Together, BridgePay and the Match Group claim represent two ends of the attack spectrum in January: one targeting operational infrastructure to extract ransom through business disruption, the other targeting data repositories to monetize stolen records through extortion and resale. Both approaches affected organizations they did not directly compromise — through service dependencies and data relationships.

The FCC Warning Small Businesses Should Take Seriously

On January 29th, the Federal Communications Commission issued a formal warning documenting a fourfold increase in ransomware attacks targeting small and medium-sized providers — particularly in telecommunications, utilities, and services infrastructure — since 2021. The warning noted that these providers frequently serve as entry points to larger organizational networks, making them preferred targets for attackers who want access to multiple downstream businesses through a single compromise.

The FCC warning is significant for a reason beyond its immediate subject matter. Federal regulatory agencies do not issue public warnings lightly — this represents an assessment that the threat to infrastructure providers is severe enough to require public disclosure and industry action. Small businesses that use telecommunications providers, managed IT services, cloud platforms, or any shared infrastructure are part of the risk landscape this warning describes.

The pattern across all three January incidents is consistent: attackers are moving up the value chain to target the platforms and processors that serve many organizations simultaneously. A single breach at a payment processor or a telecommunications provider delivers far more leverage — and far more victims — than targeting individual businesses one at a time. Understanding this shift changes how business owners should evaluate their own exposure.

What Business Leaders Should Consider

Request your vendors’ incident response procedures in writing. If a vendor like Conduent processes data on your behalf and is breached, what are their contractual obligations to notify you? What is their timeline? Ask your key vendors to provide their incident response policy and confirm that it includes timely notification to clients.
Review what data your payment processor holds and for how long. Many SMBs work with payment processors who retain transaction records, employee payment data, or customer billing information far longer than necessary. Shorter data retention means less exposure in a breach event.
Confirm that your cyber liability insurance covers third-party breaches. Standard cyber policies vary significantly on whether they cover losses that originate with a vendor rather than with your own systems. Review your policy language specifically for third-party and supply chain coverage.
Add a vendor breach notification clause to new contracts this year. Contracts with service providers should require them to notify you within 72 hours of discovering a breach that may affect your data. This aligns with most regulatory requirements and gives you the time needed to respond appropriately to affected customers or employees.

Ransomware’s Worst Year on Record: What 9,251 Attacks in 2025 Tell Business Leaders About 2026

December 9, 2025

by James with No Comment Featured Cybersecurity

The final quarter of 2025 is delivering what the data predicted all year: ransomware attacks hit 9,251 recorded incidents through November, a 45 percent increase from 2024 and the highest volume on record. For small and mid-size business owners, the headline statistic matters less than what it reveals about how attacks are changing and who is being targeted.

The Numbers Behind 2025’s Ransomware Record

Cybersecurity Ventures places global ransomware damage costs at $57 billion annually in 2025, translating to roughly $156 million per day. That figure includes ransom payments, downtime losses, data restoration costs, legal fees, and reputational damage. The ransom itself represents a fraction — the average demand for an SMB incident is $84,000. The average total recovery cost exceeds $500,000.

The IBM Cost of a Data Breach Report 2025 calculates the average cost of a ransomware-specific incident at $4.4 million across all organization sizes. For small businesses, recovery frequently follows one of two paths: organizations that absorbed significant financial damage but survived, and those that didn’t. Sixty percent of small businesses hit by a major cyberattack close within six months. One in five that experience an attack go bankrupt, according to a Mastercard survey of 5,000 SMB owners.

The 45 percent increase in attack volume between 2024 and 2025 reflects two trends converging: the rise of Ransomware-as-a-Service platforms that allow low-skill attackers to execute sophisticated campaigns, and a deliberate strategic shift toward targeting organizations with weaker defenses. Small and mid-size businesses now absorb 88 percent of ransomware incidents — not because attackers hate small businesses, but because they represent the path of least resistance to guaranteed revenue.

Padlock in server room with illuminated server racks

What Changed in 2025: Attack Methods and Entry Points

The annual shift in attack methods matters as much as the volume increase. In 2025, 32 percent of ransomware attacks entered through exploited vulnerabilities in software — meaning unpatched systems, not phishing emails. Twenty-three percent entered through compromised credentials, and 18 percent through phishing. The remainder used a mix of supply chain compromises, exposed remote access systems, and social engineering.

What this distribution tells business owners is that no single defense closes all entry points. A business that has excellent email filtering but hasn’t patched its operating systems in three months is still exposed. A business with strong passwords but no multi-factor authentication on its remote access systems is still accessible. The attack surface has expanded, and attackers are methodically searching all of it.

Double extortion — the practice of encrypting data and simultaneously threatening to publish it — was present in 87 percent of 2025 attacks, according to ransomware analysis from Huntress. This means paying the ransom no longer guarantees data stays private. Sixty-three percent of victims who experienced double extortion refused to pay, up from 46 percent in 2024, a sign that businesses are increasingly treating ransomware as a business continuity event rather than a straightforward payment decision.

The 2026 Outlook Business Leaders Should Plan Around

Three trends from 2025 are accelerating into 2026. First, AI-assisted phishing has made social engineering attacks harder to distinguish from legitimate communications — a trend that was emergent in 2025 and is becoming standard practice by year-end. Second, attackers have moved beyond encrypting local files toward targeting cloud environments, backup systems, and the management software businesses use to operate their IT — eliminating the recovery options that used to make ransomware survivable. Third, supply chain attacks have become the preferred method for scaling impact: compromise one vendor, reach hundreds of downstream businesses.

For a small business owner reading these trends, the actionable insight is not that the threat environment got worse — it’s that the threat environment is changing in specific, predictable ways. Businesses that update their defenses to account for AI-assisted attacks, cloud-targeting ransomware, and supply chain exposure will absorb the 2026 landscape differently than those operating on 2022-era assumptions.

The 9,251 attacks recorded in 2025 are not abstract statistics. They represent 9,251 decisions by specific attackers to target specific organizations they believed were within reach. Understanding what makes an organization reachable — and systematically removing those factors — is the most direct way business leaders can influence their own position in the 2026 numbers.

What Business Leaders Should Consider Before Year-End

Review your software patch status before January 1st. Thirty-two percent of 2025 attacks entered through unpatched vulnerabilities. A simple audit of your critical business software — operating systems, remote access tools, financial applications — and ensuring all pending updates are applied is one of the highest-return security actions available at no additional cost.
Verify that your backups are offline, encrypted, and tested. 2025 attacks increasingly targeted backup systems to eliminate recovery options. A backup that is connected to your network is a backup attackers can also encrypt. Offline backups, stored in a separate location and tested quarterly, remain the most reliable recovery mechanism after an incident.
Enable multi-factor authentication on every system that allows remote access. Compromised credentials account for 23 percent of entry points. Multi-factor authentication blocks the vast majority of credential-based attacks, including those where an employee’s password was exposed in a prior breach.
Set a calendar reminder for a vendor security review in Q1 2026. Supply chain attacks are accelerating. Schedule 30 minutes per key vendor to verify they carry cyber liability insurance, have completed security certifications, and can demonstrate how they protect data they hold on your behalf.
Know your cyber insurance coverage before you need it. Review your policy now — not after an incident. Understand what triggers coverage, what the deductible is, what categories of loss are included, and whether your coverage limits reflect your actual recovery costs at 2025-era attack prices.

Emergency Alerts Shut Down, 33 Million Records Stolen: Last Week’s Attacks Target the Infrastructure Every Business Depends On

November 18, 2025

by James with No Comment Featured Cybersecurity

Two incidents from the past week illustrate a threat pattern that few business owners have prepared for: attackers are now targeting the shared infrastructure that organizations like yours rely on daily, meaning a breach at a vendor you’ve never heard of can shut down your operations just as effectively as one at your own front door.

When the Emergency Alert System Goes Dark

On November 3rd, the INC ransomware group compromised OnSolve’s CodeRED platform — the system that powers emergency alert notifications for hundreds of municipalities and businesses across the United States. The attack halted the platform’s ability to send critical alerts, while attackers simultaneously exfiltrated resident contact data and attempted extortion.

For most business owners, this incident registered as a footnote. It shouldn’t. CodeRED is the kind of infrastructure that sits invisibly beneath everyday operations. Local governments use it for disaster alerts. Healthcare facilities use it for staff mobilization. School districts use it for closures and emergencies. When it fails, every organization that depends on it loses capability without having done anything wrong — or having any control over the situation.

That’s the core risk of what security researchers call “fourth-party exposure”: not just your vendors, but your vendors’ vendors. A ransomware group targeting one software company can simultaneously disrupt hundreds of businesses downstream. INC ransomware specifically targets platforms with many dependents because a single compromise delivers maximum leverage — more victims to extort, more pressure to pay.

Network operations center monitor showing system alerts

Coupang Breach: 33.7 Million Records and a Lesson About Platform Dependency

Also this week, South Korean e-commerce platform Coupang reported a data breach affecting 33.7 million customer accounts. Names, email addresses, phone numbers, shipping addresses, and partial order histories were exposed. Coupang operates across multiple countries and is used by both consumers and businesses for procurement, delivery, and operations.

The scale — 33.7 million records — places this among the largest consumer breaches of the year. But the business lesson here goes beyond the record count. A growing number of small and mid-size businesses have integrated platforms like Coupang, Amazon, Alibaba, and similar marketplaces into their core operations: supplier sourcing, product delivery, client fulfillment. When these platforms experience breaches, their business customers inherit the reputational exposure whether or not they had any control over it.

Customers don’t distinguish between a breach at your vendor and a breach at you. If their information was part of a platform you directed them to, that relationship carries liability — both legal and reputational.

The Pattern Behind This Week’s Headlines

Ransomware attacks increased 45 percent in 2025 compared to the prior year, with 9,251 recorded incidents versus 6,395 in 2024. Eighty-eight percent of those attacks targeted small and mid-size businesses. The average total cost of recovery for an SMB — including downtime, data restoration, legal fees, and lost revenue — now exceeds $500,000 per incident.

What this week’s headlines confirm is that the attack surface has expanded beyond your own systems. Attackers have learned that targeting widely-used platforms multiplies their leverage. A single compromise of a shared service — an alert system, a payment processor, a cloud application — reaches thousands of dependent businesses simultaneously. The INC group’s selection of CodeRED was not accidental. It was strategic.

Business owners who evaluate their security posture only through the lens of their own infrastructure are measuring the wrong thing. The question is no longer just “how secure are we?” It’s “how secure are the services we depend on, and what happens to our business if one of them fails tomorrow?”

What Business Leaders Should Consider

Map your critical third-party dependencies this week. List the external platforms, software services, and vendors that would disrupt your operations if they went offline for 48 hours. Include services that feel invisible — alert systems, payment processors, scheduling tools, communications platforms.
Ask your vendors one question: do they carry cyber liability insurance? If your vendors are breached and your business suffers losses, their insurance is your first line of financial recovery. Vendors who can’t answer this question clearly represent uninsured risk in your supply chain.
Review what data you share with platforms. For each third-party service you use, understand what customer or employee data you’ve provided them. The Coupang breach exposed data that customers gave the platform directly — but in many business relationships, you are the one who shared that data on a customer’s behalf.
Build a 48-hour contingency for your two most critical dependencies. What would you do if your primary payment processor, your communication platform, or your key software tool went dark for two days? Write the answer down now, not during the incident.
Request your vendors’ SOC 2 reports or equivalent security certifications. A SOC 2 Type II report is a third-party audit of a vendor’s security controls. Vendors who have completed one can provide it. Those who haven’t represent unknown risk that belongs in your vendor evaluation process.

17 Clear Signs It’s Time to Outsource IT Operations

February 3, 2025

by Morgan Melton Featured Cybersecurity Managed IT Compliance

In today’s fast-paced digital world, managing IT operations in-house can be challenging for many businesses. At DE Executive Cyber, we understand the importance of recognizing when it is time to consider outsourcing your IT functions. Here are 17 clear signs that indicate it might be time to make the switch:

1. 1. Difficulty Finding Specialized Talent:If your business struggles to find or hire specialized IT talent, outsourcing can provide access to a diverse pool of experts without the overhead costs of hiring and training.
  2. Rising Salary Costs:Managing in-house IT support can be expensive, especially with the need for 24/7 coverage. Outsourcing can reduce these costs and allow you to invest in other areas of your business.
  3. Overstretched Internal Resources:When your internal IT team is constantly overwhelmed, it can lead to inefficiencies. Outsourcing can free up your team to focus on core business activities.
  4. Low Employee Retention Rates:High turnover in your IT department can disrupt operations. Outsourcing to a vendor with a stable workforce can provide consistent support.
  5. Frequent Downtime:If your business experiences frequent IT downtime, it may be a sign that your current setup is inadequate. Outsourcing can ensure better uptime and reliability.
  6. Security Concerns:Cybersecurity is critical, and if your in-house team lacks the expertise to handle evolving threats, outsourcing to specialists can enhance your security posture.
  7. Compliance Challenges:Keeping up with industry regulations can be complex. Outsourcing to a provider with compliance expertise can help you avoid legal and compliance issues.
  8. Scalability Issues: As your business grows, your IT needs will change. Outsourcing provides the flexibility to scale your IT services up or down as needed.
  9. Lack of Innovation:If your IT team is too focused on day-to-day tasks, they may not have time for innovation. Outsourcing can bring fresh perspectives and innovative solutions.
  10. High Operational Costs:Reducing operational costs is a priority for many businesses. Outsourcing can help lower expenses related to IT infrastructure and maintenance.
  11. Limited In-House Expertise:If your team lacks expertise in certain areas, outsourcing can fill those gaps with specialized knowledge and skills.
  12. Need for Advanced Technology:Keeping up with the latest technology can be challenging. Outsourcing ensures access to cutting-edge tools and solutions.
  13. Project Delays:If IT projects are consistently delayed, it may be time to consider outsourcing to improve project management and delivery.
  14. Customer Complaints:Frequent IT issues can lead to customer dissatisfaction. Outsourcing can improve service quality and customer experience.
  15. Strategic Focus:Outsourcing IT operations allows your business to focus on strategic initiatives rather than getting bogged down by technical details.
  16. Cost Predictability:Outsourcing can provide more predictable IT costs, making budgeting easier and more accurate.
  17. Disaster Recovery Needs: Effective disaster recovery is essential for business continuity. Outsourcing can ensure you have a robust plan in place.

Conclusion

Recognizing these signs can help you make an informed decision about outsourcing your IT operations. At DE Executive Cyber, we specialize in providing comprehensive IT services tailored to your business needs. Contact us today to learn how we can help you achieve greater efficiency, security, and innovation.

Need help?

Streamline all these processes with DE Executive Cyber.

nice-young-woman-receiving-a-message-on-her-phone-2023-11-27-04-51-44-utc-min

The Benefits and Challenges of Cloud Migration

January 9, 2025

by Morgan Melton Cybersecurity Managed IT Compliance

In today’s rapidly evolving digital landscape, businesses are increasingly turning to cloud migration as a strategic move to enhance their operations. At DE Executive Cyber, we understand the critical importance of staying ahead in the tech game. Let us explore the key benefits and challenges of cloud migration.

Benefits of Cloud Migration

Cost Efficiency: Cloud migration can significantly reduce IT costs. By moving to the cloud, businesses can eliminate the need for expensive on-premises hardware and maintenance. This shift allows for a pay-as-you-go model, ensuring that you only pay for the resources you use.
Scalability: One of the standout advantages of cloud migration is scalability. The cloud provides the flexibility to scale resources up or down based on demand. This means you can easily accommodate growth without the need for substantial upfront investments.
Enhanced Security: Cloud service providers invest heavily in security measures to protect data. With advanced encryption, regular security updates, and robust disaster recovery options, your data is safer in the cloud than on traditional servers.
Improved Collaboration: Cloud-based solutions enable seamless collaboration among team members, regardless of their location. This fosters better communication, productivity, and innovation within your organization.

Challenges of Cloud Migration

Data Security and Privacy Concerns: While the cloud offers enhanced security, data breaches and privacy concerns remain a challenge. It is crucial to choose a reputable cloud provider and implement strong security protocols to safeguard sensitive information.
Downtime and Service Interruptions: Migrating to the cloud can sometimes result in downtime and service interruptions. Proper planning and choosing the right migration strategy can help minimize these disruptions.
Compliance and Legal Issues: Different industries have varying compliance requirements. Ensuring that your cloud provider complies with relevant regulations is essential to avoid legal complications.
Cost Management: While cloud migration can be cost-effective, it is important to monitor and manage usage to prevent unexpected expenses. Implementing cost management tools and practices can help keep your budget in check.

Conclusion

Cloud migration offers numerous benefits that can transform your business operations, but it is not without its challenges. At DE Executive Cyber, we specialize in guiding businesses through the cloud migration process, ensuring a smooth transition and maximizing the advantages while mitigating the risks. Contact us today to learn how we can help your organization thrive in the cloud.

Need help?

Streamline all these processes with DE Executive Cyber.

full-concentration-at-work-group-of-multiracial-b-2023-11-27-04-49-54-utc-min

Unlocking Affordable Cybersecurity: A Guide for Small Businesses

November 16, 2024

by Morgan Melton Featured Cybersecurity Managed IT

In today’s digital age, cybersecurity isn’t just a luxury—it’s a necessity. However, for small businesses operating on tight budgets and with limited personnel, crafting a robust cybersecurity strategy can seem daunting. Fear not! With the right approach, you can protect your business from cyber threats without breaking the bank.

Prioritize Immediate Threats

Small businesses must focus on the most pressing cyber threats, such as phishing attacks and malware infections. These threats are common and can cause significant damage if not addressed promptly. Implementing basic security measures like email filtering and anti-malware software can go a long way in safeguarding your business.

Educate Your Team

Your employees are your first line of defense against cyber threats. Regular training sessions on cybersecurity best practices can empower them to recognize and respond to potential threats. Topics should include identifying phishing emails, creating strong passwords, and safe internet browsing habits.

Utilize Free and Low-Cost Tools

There are numerous free and affordable cybersecurity tools available that can provide substantial protection. For instance, using password managers, enabling firewalls, and utilizing free encryption tools can enhance your security posture without significant financial investment.

Implement Multi-Factor Authentication (MFA)

Adding an extra layer of security through multi-factor authentication (MFA) can significantly reduce the risk of unauthorized access. MFA requires users to provide two or more verification factors to gain access to a system, making it much harder for cybercriminals to breach your defenses.

Regularly Update Software

Keeping your software up to date is crucial in defending against cyber threats. Software updates often include patches for security vulnerabilities that cybercriminals could exploit. Ensure that all your systems, including operating systems and applications, are regularly updated.

Backup Your Data

Data loss can be devastating for any business. Regularly backing up your data ensures that you can quickly recover in the event of a cyber attack. Use both on-site and cloud-based backup solutions to protect your critical information.

Develop an Incident Response Plan

Having a well-defined incident response plan can help you quickly and effectively respond to a cyber-attack. This plan should outline the steps to take in the event of a breach, including who to contact, how to contain the threat, and how to recover.

Conclusion

Cybersecurity doesn’t have to be expensive or complicated. By focusing on immediate threats, educating your team, and utilizing affordable tools, small businesses can build a strong defense against cyber threats. Remember, the key is to stay vigilant and proactive in your cybersecurity efforts.

Need help?

Streamline all these processes with DE Executive Cyber.

Our Solutions

Industries

Posts in category: Cybersecurity

Healthcare, Manufacturing, Legal Data: March’s Attack Wave Confirms No Industry Is Off the Target List

A Breach Doesn’t End When the Systems Come Back Online: How Business Leaders Protect and Rebuild Customer Trust

Supply Chain Attacks Are Now the Preferred Method: How One Vendor Breach Can Shut Down Dozens of Businesses

Why 1 in 5 Small Businesses Don’t Recover From a Cyberattack — And the Five Controls That Determine Which Side You’re On

A Payment Processor Goes Dark, 26 Million Records Exposed: January’s Cyberattack Roundup and What Business Owners Must Know

Ransomware’s Worst Year on Record: What 9,251 Attacks in 2025 Tell Business Leaders About 2026

Emergency Alerts Shut Down, 33 Million Records Stolen: Last Week’s Attacks Target the Infrastructure Every Business Depends On

17 Clear Signs It’s Time to Outsource IT Operations

Conclusion

Need help?

The Benefits and Challenges of Cloud Migration

Benefits of Cloud Migration

Challenges of Cloud Migration

Conclusion

Need help?

Unlocking Affordable Cybersecurity: A Guide for Small Businesses

Conclusion

Need help?

QUICk LINKS

Contact Us