Refused security help, got ransomwared, went bust. Classic.
This week's security cautionary tales come from Dave Hatter, a cybersecurity consultant at Intrust IT, who has spent years trying to help small businesses that often don't want to be helped.
Story one is grim. A small construction firm's new CFO reached out to Intrust, clearly sensing the company needed proper security support. The owner shut it down immediately. Too small to be a target. Already had someone doing IT. Too expensive. The usual.
"We got a guy, my brother's uncle's cousin does my IT, don't need you guys," Hatter recalls the owner saying. "You're too expensive."
Three weeks later, Hatter got a call from an accountant friend asking him to assist a client who'd just been ransomwared. He agreed to offer what guidance he could. Then he dialled the number and immediately recognised the company.
Same construction firm. The one that had told him to get lost a month earlier.
The setup was about as bad as it gets. A single unpatched Windows server held all the company's critical data. The only backup was an external drive plugged directly into that same server. When ransomware hit, it encrypted both. Simultaneously. The company couldn't process payroll. Couldn't tell who owed them money. Couldn't function.
Hatter had nothing useful to offer at that point. Whether the firm paid the ransom, he never found out. What he does know is that a business that had operated for years folded within months.
The lessons here aren't complicated. Backups that live on the same machine as your data aren't backups, they're a false sense of security. Unpatched servers are open invitations. And the idea that small companies are beneath a ransomware gang's notice is just wrong. These attacks are largely automated. Nobody is hand-selecting victims based on how interesting they are. If you have money and accessible systems, you qualify.
The second story is more technically interesting, and has a better ending.
Somebody compromised an executive's email account at a construction and landscaping firm. With that access, they started running a phishing campaign against a second company in the same sector. To keep things quiet, they also set up hidden inbox rules on the hijacked account so that any replies or related messages got quietly routed away from the real account owner's view.
The phishing emails were well-crafted. No broken grammar, no suspicious requests, no obvious red flags. They arrived as requests for proposals, which is exactly the kind of email a construction business wants to receive. The sender address matched the legitimate company. Recipients who'd previously corresponded with the actual executive had no obvious reason to be suspicious.
The only quirk was the attachment. Instead of a PDF or a document, there was a button to click and download the RFP.
Clicking it took the target to a Microsoft 365 login page. Pixel-perfect reproduction. Wrong domain, of course, but convincing enough. The page asked for email and password, and because the target had two-factor authentication enabled, it asked for that too.
Here's where it gets elegant in a horrible way. The attackers were running a real-time man-in-the-middle operation. As the victim typed their credentials into the fake page, those credentials were being passed straight to Microsoft's actual login system. Microsoft sent the genuine SMS verification code to the victim's phone. The victim then typed that code into the fake page, handing it directly to the attackers. Seconds later, the attackers had a live authenticated session.
From there, they had full access to the victim's Microsoft 365 account. Emails, contacts, potentially connected financial systems, customer data. The options for causing damage were substantial.
Fortunately, Hatter's client had deployed a tool called TarBot, which Intrust built to run within Microsoft 365 using Entra ID P2. It monitors login behaviour and flags anomalies. When the suspicious session appeared, it automatically revoked the access token and forced the user to re-authenticate through legitimate means.
Attack neutralised.
Hatter is clear that TarBot isn't unique. Several vendors offer similar anomalous login detection tools for Microsoft 365 environments. The broader point is that MFA alone isn't sufficient against a determined attacker running a real-time phishing proxy. You need something watching for sessions that don't look right even after authentication succeeds.
Two stories. One business that saved pennies on security and lost everything. One that had the right tools in place and walked away intact. The contrast is not subtle.