Why YOU Are Cybercriminals' #1 Target in Houston

Most of the Houston business owners I meet share the same quiet belief: cybercriminals are after the big corporations, not a company their size. It’s a comfortable thought. It’s also a false sense of security, built on a handful of misconceptions I want to take apart in this post.

This is adapted from Chapter 4 of my book, Protecting Your Business Against Hackers. If you’d rather read the whole thing, you can download the full book here.

Misconception #1: “We’re Too Small to Be a Target”

On the surface, this seems logical. Why would a criminal bother with a small business when global giants like J.P. Morgan, Target, Experian, Home Depot and Yahoo have far more money and data to steal? Those are the names you see in the headlines.

That’s exactly what cybercriminals are counting on you to believe. It makes small businesses easy prey, because owners who think this way tend to put zero protections in place, or grossly inadequate ones.

Think about it this way: why don’t you hear about banks being robbed anymore? Because criminals know banks have sophisticated security. It’s hard to rob one and nearly impossible to get away with it. So most criminals go after soft targets instead: homes, gas stations. The same logic drives cybercriminals to small businesses rather than the Fortune 500. They know you’re not spending millions on cybersecurity, and you don’t have a large IT team watching your assets around the clock.

The National Cyber Security Alliance reports that one in five small businesses have been victims of cybercrime in the last year, and that only counts the ones who self-reported. Most don’t, out of embarrassment or fear of the PR fallout. The real number is almost certainly far higher. If you never put stronger protections in place, you’re a sitting duck waiting to become a statistic.

Misconception #2: “We Already Have Adequate Protection”

If you have an IT department, or even one IT person, you may feel like there’s already a shield around your network and files. But be honest: are your protections anywhere close to the security budgets of eBay, Marriott, Equifax, Uber, Home Depot or Google?

Those titans get hacked anyway:

• In November 2018, cyberthieves stole data from roughly 500 million Marriott customers (Marriott’s official disclosure). The attackers had been inside the network since 2014, undetected for four years.
• Equifax, one of the largest credit bureaus in the country, exposed 147.9 million customers, with 209,000 having credit card data compromised (FTC settlement announcement).
• Around 5 million Google Gmail usernames and passwords were compromised and leaked on a Russian forum (Time coverage).

If companies with the newest security tools and scores of experts can get breached, so can a small business like yours. The difference is they can absorb the hit. You may not be able to.

What’s Really at Stake When You Get Hit

People imagine a breach as a single bad day. In reality, one event can trigger an avalanche of disruption that lasts months or years, and for some businesses, there’s no recovery at all. Here are the dominoes that fall.

A Mountain of Costs

One breach, one ransomware attack, or one rogue employee creates untold hours of extra work for your whole team. Add business interruption, downtime, and backlogged work for your current clients, and it’s common to see sales slide for weeks or months.

Then come the hard costs:

• Forensics to determine what kind of attack happened and what data was compromised.
• Emergency IT restoration to get you running again, if that’s even possible.
• Ransom payments, if it was ransomware. And remember, you’re trusting criminals to honor their word. You may pay and still not get your data back. The price may even go up.

According to the Ponemon Institute’s Cost of a Data Breach study, the average cost is $225 per compromised record. Count your records (clients, employees, prospects) and multiply. You’ll quickly get a sense of the exposure. (Health care breaches are the costliest of any industry, and a single practice can hold thousands of patient records.)

Government Fines, Legal Fees and Lawsuits

When you’re breached, the government is often first in line. Forty-seven states and the District of Columbia have their own data breach laws, and they’re getting tougher. They don’t care that a crime was committed against you. They expect you to pay punitive fines anyway.

If you’re in health care or financial services, you face extra notification requirements under HIPAA, the SEC and FINRA. When a breach touches more than 500 clients, you’re even required to notify a major media outlet, which is exactly when the public relations firestorm ignites.

Then there are legal fees and the lawsuits that follow. In today’s litigious climate, you can expect customers, vendors or employees whose data was stolen to sue. Proving your security was sufficient is usually a losing battle, and the losses run from tens of thousands to far more.

Loss of Reputation and Customers

Your reputation is your business. After a breach, you’re responsible for telling every affected customer their information was stolen so they can protect themselves. Nobody enjoys delivering that news, but it has to be done.

The numbers are sobering: 83% of US consumers say they’ll stop spending at a business for months after a breach, and 21% will never come back. Many will vent on social media and review sites, smearing your name in public.

And whatever you do, don’t try to cover it up. Yahoo and Uber learned that the hard way, facing class-action lawsuits for not telling users promptly. Modern forensics can trace a breach right back to where and when it happened. There’s nowhere to hide. Customers may forgive a mistake. They won’t forgive being lied to.

Bank Fraud: They Want Your Money, Not Just Your Data

Not every attacker is after customer records. Many target you directly to steal money. And the assumption that your bank will simply replace stolen funds is not always true.

Consider Verne Harnish, CEO of Gazelles, Inc. He used free public WiFi abroad, which let hackers grab his email credentials. They studied his sent mail, mimicked his writing style, and emailed his assistant requesting wire transfers to three locations, then deleted his bank alerts so he wouldn’t notice. The requests looked routine, the assistant complied, and the criminals stole $400,000. The bank wasn’t responsible, and the money was never recovered.

One simple safeguard: set up both email and text alerts for every financial transaction, including credit and debit cards, and actually review each one.

The False Sense of Security

Right now you might be thinking, “My assistant would never do that.” That’s what everyone thinks (not my assistant, not my employees, not my company) until it happens to them.

Nobody expects a car wreck when they leave the house, yet you still buckle up. You don’t anticipate a crash; you just refuse to be unprotected if one comes. Your business deserves the same logic. The first step is admitting you’re a likely target. The next is closing the gaps before someone finds them for you, which is exactly what a cybersecurity risk assessment is built to do.

Get a Free Cybersecurity Risk Assessment

Frequently Asked Questions

Are small businesses really targeted more than large ones?

Yes. Cybercriminals deliberately favor small businesses because, like a burglar choosing a house over a bank, they’re easier to get into. Large enterprises spend millions on defense; most small businesses have little to none. The National Cyber Security Alliance found one in five small businesses were hit in a single year, and that only counts the ones who reported it.

My business already has IT support. Isn’t that enough?

Not necessarily. Having an IT person or department doesn’t mean you have enterprise-grade security. Marriott, Equifax and Google all had large security teams and still suffered massive breaches. What matters is a layered, proactive defense. See our cybersecurity services page for how those pieces fit together.

How expensive is a data breach really?

Costs stack up fast: forensics, emergency restoration, possible ransom, government fines, legal fees, lawsuits and lost customers. The Ponemon Institute pegs the average at $225 per compromised record, so multiply that by every client, employee and prospect record you hold. For many small businesses, a single breach is enough to threaten survival.

Will my bank just replace money stolen by hackers?

Often, no. If your account is accessed and funds are wired out, the bank is frequently not responsible for replacing them, as the Verne Harnish case shows, where $400,000 was stolen and never recovered. Setting up email and text alerts on every transaction is a simple, effective safeguard.

Ready to Find Out Where You Stand?

If this chapter made you a little uncomfortable, good. That discomfort is the push most owners need. The businesses that come through a cyberattack intact are the ones that acted before it happened, not after.

We work with Houston companies of 10 to 200 employees, giving them enterprise-level protection without an in-house security team, all for one flat monthly fee, with fast response when something goes wrong, including after-hours. Book a free discovery call, request a cybersecurity risk assessment, or call us in Houston at 281-367-8253.