Ransomware is no longer just a problem for big corporations. Across the U.S., dozens of small cities and counties have been forced offline by devastating attacks. Police departments have reverted to paper filing, finance systems have been frozen, and public utilities have been disrupted.
While headlines focus on governments, the uncomfortable truth is this: attackers don’t care whether you’re a city or a small business — they care about leverage. And small and midsize businesses (SMBs) often have the same weaknesses as local governments: outdated systems, limited IT staff, and untested backups.
Cybercriminals know this. They know that smaller organizations rarely have 24/7 monitoring, that budgets are stretched thin, and that leaders may feel forced to pay the ransom just to survive. That’s why SMBs and municipalities alike are prime targets.
If your organization relies on technology to operate — and most do — ransomware isn’t a matter of if, it’s a matter of when. Pretending otherwise is gambling with your business’s future.
Why Ransomware Targets SMBs and Governments Alike
Attackers don’t discriminate between a city hall and a construction company. They look for:
- Outdated operating systems and software that lack patches.
- Weak or stolen credentials that give them a foothold.
- Flat networks where once inside, they can move freely.
- Backups that exist but aren’t tested — giving victims a false sense of security.
For attackers, it’s about leverage. Whether the victim is a water utility or an accounting firm, the question is the same: How much disruption will make them pay quickly?
Lesson 1: Backups Must Be Tested, Not Just Stored
Many SMBs assume they’re safe because they have backups. But a backup that hasn’t been tested in months may be unusable when disaster strikes.
- Quarterly restore drills are now mandatory in many city governments.
- Testing ensures backups are complete, accessible, and recoverable under pressure.
- A successful test can mean the difference between days of downtime and business continuity.
For SMBs, testing backups doesn’t have to be complex — it can often be done in an afternoon.
Lesson 2: Identity and Access Controls Are Non-Negotiable
Nearly every ransomware campaign starts with stolen credentials. Attackers gain access to a single account, then escalate privileges until they can encrypt the network.
Practical defenses SMBs can deploy quickly:
- Multi-Factor Authentication (MFA): Stops most credential-based attacks in their tracks.
- Least privilege access: Employees only get the permissions they need.
- Just-in-time administrator rights: Temporary elevated access instead of always-on privileges.
Governments that once gave every department broad access are now paying the price. SMBs must learn from those mistakes.
Lesson 3: Practice Makes Perfect (Even in Cybersecurity)
When ransomware strikes, panic is often the biggest enemy. Organizations that have never rehearsed a response lose precious hours debating who to call, what to shut down, and how to notify employees or customers.
Tabletop exercises — simulated attacks where leaders walk through a step-by-step response — dramatically improve readiness.
- A 90-minute drill once a quarter is one of the most cost-effective cybersecurity investments any organization can make.
- Teams learn how to contain damage, communicate clearly, and restore operations faster.
The SMB Advantage: Speed
Here’s the silver lining: SMBs actually have an advantage over governments.
- A business with 50 employees can roll out MFA across the board in a single week.
-
Testing backups can be done in one afternoon.
-
Segmentation and access policies can be updated within days, not months.
The problem isn’t complexity — it’s awareness. By learning from the hard lessons municipalities are facing, small businesses can move faster and smarter to protect themselves.
The Bottom Line
Ransomware groups aren’t slowing down. They are professionalized, organized, and increasingly targeting smaller organizations that lack enterprise-grade defenses. But SMBs don’t have to be easy targets.
By focusing on tested backups, strong identity and access management, and practiced incident response, your business can dramatically reduce the likelihood of paying a ransom — or even being successfully attacked in the first place.
The key takeaway: Ransomware isn’t just a government problem. It’s an SMB problem. And the time to act is now.
