How Ransomware Attacks Target Small Businesses in Houston (And How to Stop Them)
Most small business owners in Houston assume cybercriminals are focused on large corporations. The reality is the opposite. Small businesses are the most common ransomware target by volume of incidents, and a 22-person company can be fully researched, attacked, and ransomed within a single week using tools that cost an attacker less than $20.
At Griffin Technology Solutions, we work with small and mid-sized businesses across Houston to close the gaps that make these attacks possible. This article walks through exactly how a ransomware attack unfolds against a small business, written from the attacker's perspective, so you can see where your company might be exposed. At the end, we cover the five specific controls that would have stopped each stage of the attack, most of which are already included in tools you are likely paying for right now.
Why Small Businesses in Houston Are Prime Ransomware Targets
Ransomware operators run volume-based businesses. Their sweet spot is companies with 10 to 50 employees. Here is why that range works for them:
Large enterprises have dedicated security teams, incident response contracts, and legal resources that make attacks expensive and complicated.
Sole traders rarely have enough revenue or data to justify the effort.
A 22-person commercial services company has payroll files, a customer database, project documents, supplier relationships, and an owner who will pay to get everything back.
The attacker's return per hour is better at this size than at either extreme. If your Houston business falls in that range, you are in the target zone.
Monday: How Attackers Find You Using Public Records
A ransomware operator spends Monday morning with nothing but a browser and a short list of prospects. About 40 companies per month is a typical volume for a small-scale operation.
They are not finding you through a data breach or inside tip. They are finding you through public records. State business registries, federal contract award databases, and county-level licensing portals publish enough detail to identify your company, estimate your revenue, look up your name, and pinpoint the most useful person inside your organization.
One search can return your company name, your registered agent, the contract value of a recent municipal project, and the named contact on the submission.
A clean record with no known incidents is actually a positive signal to an attacker. It tells them your credentials are probably still valid, your staff has not received security training, and no one has had a reason to change a password recently.
Tuesday: Building Your Org Chart for Free
Forty minutes of open-source research using only a browser is enough to map out who does what inside your company.
LinkedIn alone can reveal multiple employees with their job titles listed. A profile that includes phrases like "accounts payable, payroll, and supplier invoicing" tells an attacker exactly who handles your money and what access they have. Job postings on Indeed can confirm which accounting software your office uses. A "meet the team" post on Facebook can provide names, faces, and tenure.
The person who ends up as the primary target is usually not the business owner. It is the person with system access, payment authority, and a full inbox who is unlikely to scrutinize one more email carefully.
The attacker has not spent a dollar yet.
Wednesday: Your Credentials Purchased for $14
Stealer logs are credential packages harvested by infostealer malware that infected someone's personal device, sometimes months or years earlier. The malware records every username and password typed into the machine and bundles the data for sale on Telegram channels and dark web forums.
An attacker searches for your company's email domain. A $14 purchase returns two credential sets: one belonging to your office manager, and one tied to a personal account connected to someone in your household.
The office manager's password follows a pattern seen constantly in compromised credential data: a name combined with a year and a special character. A free check on HaveIBeenPwned confirms it appeared in a breach three years earlier. The password has not been changed since.
The household account is more valuable than it looks. The same password, with minor variations, has been reused across a streaming service, a gaming account, and your company's Microsoft 365 login. It works. The only obstacle remaining is the second factor.
Total attacker spend: $14.
Thursday: Getting Past Your MFA
Multi-factor authentication stops a significant number of attacks, but how it is implemented determines whether it actually protects you.
Push notification fatigue bombing no longer works against Microsoft 365 accounts. Microsoft enabled number matching by default for all Microsoft Authenticator push notifications in May 2023. Users now have to type a code from their login screen rather than simply tapping approve.
What still works is adversary-in-the-middle (AiTM) phishing.
The attacker sends your office manager an email that appears to be a Microsoft 365 password reset notification, referencing the very breach her credentials appeared in. The link leads to a page that mirrors the real Microsoft sign-in screen exactly. That page is a proxy controlled by the attacker.
When she enters her password and approves her MFA prompt, the proxy forwards both to the real Microsoft server. Microsoft validates the credentials, completes the MFA challenge, and issues a session token back to the proxy. The attacker captures the token. She sees a normal login experience followed by a "password updated successfully" message.
The attacker is now signed into her account. The MFA prompt succeeded, but the session token sits in the attacker's browser instead of hers. Microsoft sees a valid authenticated session.
By Thursday night, a hidden inbox forwarding rule is in place. Every email she receives is copied silently to an address the attacker controls. Then they wait.
Friday 2:47 PM: Why the Attack Was Timed for the End of the Week
The attacker spends 36 hours reading email before encrypting anything. That dwell time is how they size the ransom correctly.
In those 36 hours, they find:
Your cyber insurance policy, with a liability sub-limit of $250,000
A bank reconciliation showing your business account balance at month end
Your full customer list inside a quote template
A message thread mentioning a municipal project starting in three weeks with a hard deadline you cannot miss
The ransom is set at $65,000 in cryptocurrency. Low enough that you will pay rather than fight. High enough to be worth the effort. Well within what they know you can access. Ransoms set above 10 percent of visible liquid assets tend to get contested. This one sits below that line.
Encryption deploys at 2:47 PM on a Friday. Your bookkeeper finishes at 3 PM on Fridays. You are on a job site. The person most likely to notice and call for help is already gone. The person with authority to respond is unreachable.
By Friday evening, every file on your shared drive is encrypted. A ransom note is on every screen in your office.
Total attacker cost: $14 and approximately six hours of work.
Five Places This Attack Would Have Been Stopped
Each of the following controls maps directly to a stage in the attack above. None of them require a large purchase. Most are already bundled into tools small Houston businesses are already paying for.
1. The Credential Purchase on Wednesday
HaveIBeenPwned is free and available to anyone. Microsoft Entra Password Protection can detect and block reused or commonly compromised passwords across your accounts. Enforcing unique passwords through a password manager combined with Entra's policies makes a $14 credential purchase useless before the attacker ever tries to log in.
2. The MFA Bypass on Thursday Night
Microsoft's default rollout of number matching has already closed the simpler push-bombing attack. The current dominant bypass is adversary-in-the-middle phishing, which captures session tokens rather than credentials.
Defenses include:
Phishing-resistant MFA such as FIDO2 hardware keys, passkeys, or Windows Hello for Business
Conditional Access policies that require a compliant or hybrid-joined device
Anti-phishing protection through Microsoft Defender for Office 365
Any one of these would have either prevented the session token capture or made the captured token unusable from the attacker's IP address.
3. The Inbox Forwarding Rule
Microsoft 365 allows administrators to block external email forwarding rules at the tenant level. With that block in place, the forwarding rule used to monitor 36 hours of email would not have worked. The attacker might have encrypted anyway, but they would have been guessing on the ransom amount rather than working from your actual bank balance and insurance policy.
4. The 36-Hour Dwell Time
Microsoft Defender for Business, which is included in Microsoft 365 Business Premium, generates an alert when a new inbox forwarding rule is created. If someone had been reviewing those alerts, or if the alerts had been routed somewhere visible, the attacker would have been detected on Thursday night.
For most small businesses, the highest-impact improvement is not a new product purchase. It is making sure someone is actually reviewing the security alerts that existing tools are already generating.
5. The Public Research Stage
You cannot remove your company from a state contracting registry or a federal contract award database. That data will remain public. What you can control is what your team shares about their specific responsibilities on public profiles.
A LinkedIn profile listing detailed financial responsibilities in plain language identifies the most valuable target in your organization to anyone who is looking. A practical security awareness conversation with your team, framed around what is useful versus what is unnecessary to share publicly, costs nothing and removes a meaningful piece of attacker reconnaissance.
Three Questions to Ask Your IT Provider Today
These three questions cover the majority of the attack stages described above. Each one corresponds to a control bundled with tools most small businesses in Houston already pay for.
Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
Is external email forwarding blocked at the tenant level in Microsoft 365?
Are our security alerts going somewhere, and is someone reviewing them?
If you do not have clear answers to all three, that is a good place to start.
Griffin Technology Solutions Helps Houston Businesses Close These Gaps
Griffin Technology Solutions provides managed IT services and cybersecurity support to small and mid-sized businesses throughout Houston, Texas. We help businesses get full value from the tools they are already paying for, including Microsoft 365 Business Premium, and we close the configuration gaps that ransomware operators rely on.
If you would like a straightforward review of where your business stands on the controls described in this article, contact our team. We work with companies across Houston and the surrounding area.
Griffin Technology Solutions | Houston, TX | [Your Phone Number] | [Your Website URL]
Frequently Asked Questions About Ransomware and Small Business Security
Do hackers target small businesses?
Yes. Most ransomware operations target small and mid-sized businesses because the ratio of payout potential to defensive resources is higher than at either extreme of company size. The volume sweet spot is roughly 10 to 50 staff, where there are assets worth encrypting but no dedicated security team to defend them.
What is adversary-in-the-middle (AiTM) phishing?
AiTM phishing is a technique where the attacker hosts a proxy page that mirrors a real login screen, such as Microsoft 365. When the user enters credentials and approves the MFA prompt, the proxy captures the resulting session token. The legitimate service treats the login as successful, but the session token ends up in the attacker's browser. AiTM has become the dominant credential-based attack vector against Microsoft 365 tenants since the default rollout of number matching ended simpler push-bombing attacks.
What is a stealer log?
A stealer log is a package of credentials harvested by infostealer malware from an infected personal device. These logs include browser-saved passwords, session cookies, and stored authentication tokens, and they are sold on underground markets for $10 to $20 per package. The malware that creates them typically infects personal computers through pirated software or malicious browser extensions.
How much does it cost an attacker to compromise a small business?
In the walkthrough above, the total attacker spend was $14 for stolen credentials and approximately six hours of work spread across the week. The threshold to attempt this type of attack sits well below $100.
Are there affordable tools that would have stopped this attack?
Most of the controls referenced in this article come bundled with Microsoft 365 Business Premium licenses that businesses in this size range typically already hold. External forwarding restrictions and Defender for Business alerts are configuration changes, not new purchases. HaveIBeenPwned is free. Phishing-resistant MFA hardware keys carry a small per-user cost that is minimal compared to the cost of a successful ransomware incident.
How can a Houston small business improve its cybersecurity quickly?
Start with the three questions listed above. Confirm that phishing-resistant MFA is in place for your highest-risk accounts, that external email forwarding is blocked at the tenant level, and that someone is reviewing your Microsoft 365 security alerts. Griffin Technology Solutions can help Houston businesses work through these steps efficiently.
Not Sure If Your Business Is Protected?
We can tell you in one conversation. Contact us today.