Hacked: What a Cyber Attack Really Looks Like for a Small Firm

What Actually Happens When a Small Business Gets Hacked?

It usually starts with a phone call. Someone in the office can’t open a file. Then a colleague can’t either. By the time the director sits down with their morning coffee, every shared folder is showing the same message: your files have been locked, and here’s how to pay to get them back.

Most business owners have a vague sense that this happens. Far fewer know what the next few days look like, and that uncertainty is what makes it feel so frightening.

Let’s walk through it. The story below is a composite of how these attacks typically unfold. It’s not one real business, but every part of it is realistic. And at the end, we’ll show you how the same morning goes for a business that’s properly protected.

Hour by hour: how an attack unfolds

Meet a small design agency in Leeds. A dozen people, good clients, busy. IT is handled by a freelancer who pops in when something breaks.

A few weeks earlier. A designer gets an email that looks like a Microsoft 365 login warning. She clicks, types her password, and thinks nothing more of it. There’s no two-step sign-in on her account, so that password is all anyone needs. Someone quietly logs in and starts looking around.

Friday night. With everyone gone home, the attacker uses that access to run software that scrambles every file it can reach: the shared drive, the laptops left on, the synced folders.

Monday, 8:45am. The first call. “I can’t open the Henderson brief.” Then another. Every file now has a strange name and won’t open.

9:30am. The director finds the ransom note. Pay in cryptocurrency within 72 hours or lose everything.

10:00am. They ring the freelancer. He’s on a job in Wakefield and can’t get there until the afternoon.

11:00am. Someone remembers the backup drive in the cupboard. It was last plugged in months ago. The cloud folders didn’t help either: they faithfully synced the scrambled files.

Midday. Two client deadlines are this week. Nobody can work. The director starts drafting emails to clients, unsure how much to say or what to say.

Afternoon. The freelancer arrives and confirms the worst. Then the hard questions start. Do we pay? Was client data taken? Do we need to tell anyone?

The costs nobody sees coming

The ransom is the part everyone fixates on. It’s rarely the biggest cost. The ones that hurt more are quieter:

• Lost days. Every hour nobody can work is wages paid, deadlines missed and invoices that don’t go out.
• Someone must clean every device, rebuild what can be rebuilt and check the attacker is really gone. That’s skilled work, usually at emergency rates.
• Client trust. Telling clients their files may have been seen is a hard email to write. Some will understand. Some will quietly move on.
• The ICO. If personal data may have been accessed, UK GDPR can require you to report it to the Information Commissioner’s Office within 72 hours of finding out. Get advice quickly on whether that applies to you.

And paying the ransom doesn’t solve things either. UK law enforcement encourages businesses not to pay, and the National Cyber Security Centre’s guidance is clear that paying doesn’t guarantee you’ll get your files back, or that your data won’t be leaked anyway.

How long recovery takes without proper backup

For our Leeds agency, Monday is only the start.

Without a recent, clean backup, recovery means rebuilding. Every laptop gets wiped and set up again. Files are pieced back together from email attachments, old downloads and whatever clients can send back. Some work is simply gone.

That can take days. For some businesses it’s weeks before things feel normal, and the stress lands on the director, who’s trying to keep clients happy while the business can barely function.

The frustrating part? Almost all of it was avoidable. Not with expensive kit, but with a handful of basics that were never quite set up. Many businesses assume their cloud storage is a backup. It isn’t, which is exactly why we wrote about whether your Microsoft 365 data is really backed up.

The same story at a protected business

Now rewind and give the same agency managed IT support.

A few weeks earlier. The same fake login email arrives. Email protection catches most of these before they reach anyone. But say this one gets through and the designer types her password. It doesn’t matter: two-step sign-in means a stolen password alone won’t get anyone in.

Say they get further anyway. Monitoring flags a login that doesn’t look right. The account is locked and the password reset before anything else happens.

Monday, 8:45am. Nobody calls, because nothing’s wrong. If the worst had happened, daily backups would mean files could be restored from before the attack, and the team would be back at work far sooner.

Same business. Same email. A completely different Monday. That’s what proactive IT means in practice: the problem is dealt with before it becomes your problem.

The three things that would have stopped it

Look back at our Leeds agency’s story. Three gaps made it possible, and each one is fixable:

1. Two-step sign-in. The whole attack hinged on one stolen password. With a code from her phone required too, it would have ended there.
2. Proper, tested backups. Not just files synced to the cloud, but separate daily backups that ransomware can’t scramble, and that someone has checked can be restored. Our Backup Lite service covers exactly this.
3. Someone watching. An attacker poking around for weeks leaves traces. Round-the-clock monitoring spots them. Someone who only visits when something breaks can’t see them.

None of these are exotic. They’re the basics, done properly and kept up to date. If you’d like a fuller list you can work through yourself, our guide to protecting your small business from a cyber attack has quick wins you can do this week.

Are you protected?

Most business owners don’t know whether these three things are in place. That’s not a failing; it’s just not your job to know.

It is ours. Book a free 15-minute security chat and we’ll tell you, in plain English, where you stand and what, if anything, is worth fixing. No scare stories, no pressure. It’s just a conversation.