Ransomware in Small Businesses: What to Secure First

Ransomware attacks on small businesses in Brazil are no longer just a concern for banks and multinational corporations. In 2026, Brazil has already recorded more public victims than in all of 2025, and most attacks don't require sophisticated techniques. This guide uses verified data to show how ransomware groups are gaining entry and what an SMB should prioritize securing this week, with their existing budget.

TL;DR

• According to data from Ransomware.live, Brazil recorded 203 victims on leak sites between January and October 18, 2026, compared to 149 for all of 2025.
• The second half of the year saw a significant increase: from 13-19 victims per month in the first half to 26-29 per month from July to October.
• Entry points are consistent: unpatched vulnerabilities (32% of attacks in the Sophos report), stolen credentials (23%), and exposed remote access, such as VPN and RDP without MFA.
• The correct order for an SMB is: MFA on all remote access, updated firewall/VPN, RDP off the internet, tested offline backup, and a one-page incident response plan.
• Purchasing another tool before addressing these five items is misallocating resources.

What the 2026 Numbers Show About Brazil

Before any recommendations on ransomware in small businesses, let's look at the data. And with a caveat that almost no one considers when citing ransomware statistics.

Ransomware.live is a project that monitors the leak sites of criminal groups and records each victim they announce. I consulted the Brazil series on October 18, 2026:

Month (2026)	Victims in Brazil
January	19
February	14
March	15
April	16
May	13
June	16
July	28
August	29
September	27
October (through the 18th)	26

Two facts stand out from the table. First, the accumulated total for 2026 (203) has already surpassed the entire year of 2025 (149) with two and a half months remaining. Second, October, with 18 days, already matches full months from the previous semester.

The Trend of Increases and Why the Numbers Change

Monthly reports published by the press showed one increase after another: 23 victims in June, 26 in July, 27 in August, and 31 in September. This marked the third consecutive month of increases. In September, according to Cohesity's survey based on Ransomware.live, Brazil rose from sixth to the third position globally and was the only country among the top eight most attacked to see growth. During the same period, the global total fell from 1,212 to 881 victims.

Note that these numbers do not match the table above. This is not an error. The database is reprocessed: an announcement can be re-dated, removed, or attributed to a different month. Therefore, always cite the consultation date. And remember that the number measures announced victims, not attacks. Those who pay silently do not appear. The real number is higher.

Who is Attacking and Who is Being Attacked

In 2026, the groups with the most Brazilian victims on Ransomware.live are The Gentlemen (33), LockBit 5 (23), Inc Ransom (11), Qilin, and Krybit (8 each). The most affected sectors are professional services (36), industry (32), technology (27), and healthcare (20).

Professional services include accounting firms, law offices, engineering firms, and consultancies. In other words, the typical profile of ransomware in Brazilian small businesses is a firm of ten to fifty people, with a file server and remote access for working from home.

Why Ransomware in Small Businesses Became the Preferred Target

The idea that "no one will attack a company my size" stems from a false premise: that someone specifically chooses you. In most cases, no one chooses. A bot scans the internet for a vulnerable VPN or a leaked password, and your company appears on the list.

The quarterly report from Coveware by Veeam for the second quarter of 2026 shows that 18.2% of victims served had between 11 and 100 employees. The median ransom paid was $150,000. Converted at the day's exchange rate, this easily exceeds half a million Brazilian Reals, before accounting for downtime, contractual penalties, and lost clients.

Ransomware in small businesses is also more profitable than it seems for criminals for three practical reasons:

• Weaker defenses. There's no dedicated security team, and often not even full-time IT staff. The "IT guy" is a contractor who shows up when something breaks.
• Total reliance on a few systems. If the file server and ERP go down, the company stops. This increases the pressure to pay.
• Double extortion. Today, groups copy data before encrypting it. Coveware reported that data exfiltration occurred in 76% of cases. Even those with backups are threatened with the publication of customer data.

In the Sophos report, covering 3,400 companies from 17 countries, the average recovery cost, not including the ransom, was $1.53 million. This average is skewed by larger companies, but it demonstrates the order of magnitude: recovery always costs more than prevention.

Entry Point #1: Leaked Credentials and Weak Passwords

The cheapest way to initiate a ransomware attack on small businesses is to walk right through the front door, using legitimate usernames and passwords.

Sophos identifies compromised credentials as the cause of 23% of attacks. Coveware reported that in the second quarter of 2026, the use of stolen credentials rose again, while phishing and social engineering regained the lead. The two often go hand-in-hand: phishing steals the password, and the password opens the VPN.

Where These Passwords Come From

• Infostealers. These are viruses that steal passwords saved in the browser of an infected computer, often an employee's personal laptop where they also access company email.
• Breaches of other services. The employee uses the same password for a leaked e-commerce site and the company's VPN.
• Brute force. Bots testing combinations. The S-RM consultancy observed The Gentlemen group brute-forcing VPNs where MFA was not enabled.

On the Linux servers we manage, automated SSH login attempts arrive every day, without exception, even on servers no one knows about. It's not a targeted attack. It's internet background noise, and it only works against those who leave the door ajar.

What to Secure

1. MFA (multi-factor authentication) on all remote access: VPN, email, hosting panel, cloud ERP, administrator accounts. I've detailed the methods and what to avoid in the guide on multi-factor authentication for businesses.
2. Eliminate generic and shared accounts ("finance," "admin," "support"). Each person should have their own user account.
3. Deactivation on the same day an employee leaves the company. Active ex-employee accounts are one of the most common entry points in small incidents.
4. Corporate password manager, so no one needs to reuse passwords.

When it's not enough: SMS-based MFA is still better than nothing, but it doesn't protect against SIM swap attacks or employees who approve a notification without reading it. For administrator accounts, use an authenticator app or a physical key.

Entry Point #2: Misconfigured Remote Access

Since the pandemic, almost every SMB has opened some form of remote access. Many did so in the quickest way, not the most secure. This is the second major entry point for ransomware in Brazilian small businesses.

RDP Exposed on the Internet

RDP is Windows' native remote access. Leaving its port open to the internet, for "the accountant to access from home," is practically inviting an attack. Blackpoint lists exposed RDP among The Gentlemen's vectors. The rule is simple: RDP should never be directly on the internet. Always behind a VPN with MFA or an access gateway.

VPN and Edge Firewall

Here lies the most underestimated problem. The equipment meant to protect the company becomes the entry point.

Two recent cases illustrate this:

• SonicWall and the Akira group (2025). Between July and October 2025, Akira breached companies via SonicWall firewall SSL VPNs, exploiting vulnerability CVE-2024-40766, which had been patched for almost a year. The Canadian Centre for Cyber Security issued an alert. A detail every manager should remember: many victims had migrated firewalls without changing local account passwords. The equipment was new, the credentials were old.
• FortiGate and The Gentlemen (2026). The group with the most victims in Brazil this year primarily uses, according to market analyses, vulnerability CVE-2024-55591 in FortiOS, which allows authentication bypass. Fortinet published the patch in January 2025.

Notice the pattern: known and patched vulnerabilities, exploited months or years later.

What to Secure

• Inventory of what's exposed. List everything that responds from the internet: VPN, RDP, firewall panel, cameras, NAS, email server. If you don't know, that's your first task.
• Firewall administrative panel closed to the internet. Management only via the internal network or by authorized IP.
• Reviewed local VPN accounts. Delete unused ones. Change all passwords after any migration or incident.
• Geoblocking and attempt limits, where the equipment allows. This doesn't solve everything alone, but it eliminates much of the noise.

Entry Point #3: Old, Unpatched Vulnerabilities

At Sophos, vulnerability exploitation was the number one technical cause for the third year in a row, accounting for 32% of attacks. This isn't about new, unknown, movie-worthy flaws. It's old systems that no one updated, the most common scenario for ransomware in Brazilian small businesses.

In SMBs, old vulnerabilities typically reside in four places:

Where it is	Typical Example	Why it remains unpatched
Firewall and VPN	Two-year-old firmware	"If I update, the internet might go down"
Windows Server	Unsupported Windows Server	The old ERP "only runs on it"
Web Systems	Outdated WordPress, Moodle, or PHP	No one owns the maintenance
Forgotten Equipment	NAS, cameras, printers	No one remembers they're connected

The U.S. agency CISA maintains the catalog of actively exploited vulnerabilities. This is the best yardstick for an SMB's priorities: if a flaw is on this list and your equipment has that flaw, patching becomes urgent, not "next month's item."

How to Do It Without Halting Business Operations

• Fixed update window, for example, every Tuesday night, with prior notice.
• Prioritize what's at the edge. Firewall, VPN, and exposed servers first; internal workstations later.
• Plan for what cannot be updated. If a legacy system requires an older Windows version, isolate that machine on a separate network, without internet access and no direct remote access.

In our day-to-day work with managed hosting and Moodle servers, the rule is the same: security updates have a scheduled date and don't depend on someone remembering. I've already written the step-by-step for servers in the Linux server hardening checklist.

What to Secure First Against Ransomware in Small Businesses

Every security checklist has forty items. An SMB doesn't do forty items. It does five, done well. This is the order I recommend to reduce the risk of ransomware in small businesses at the lowest cost:

1. MFA on all remote access and all administrator accounts. Low or zero cost, immediate effect. Cuts off most credential-based attacks.
2. Updated firewall and VPN, with the administrative panel closed to the internet. An afternoon's work for a technician. Closes the entry point that the most active groups in Brazil are using.
3. RDP off the internet. Often, it's just a matter of closing a firewall rule.
4. Backup following the 3-2-1 rule, with an offline or immutable copy, and tested restoration. Three copies, on two types of media, one out of network reach. Backups located on the same server or a network-accessible share will be encrypted along with everything else.
5. One-page incident response plan. Who shuts down what, who calls whom, where the backup is, who communicates with clients.

When NOT to Spend Money Yet

The most expensive mistake in combating ransomware in small businesses is buying tools before fixing the basics.

• Don't buy "next-gen" antivirus before addressing item 1. The tool won't help if the criminal enters with the manager's password.
• Don't hire a 24/7 SOC (Security Operations Center) if you still don't know what's exposed on the internet. Monitoring a disorganized environment generates alerts that no one reads.
• Don't trust a backup that has never been restored. Sophos reported that recovery via backup is at its lowest level in six years. Many backups only exist on paper.

Regarding backup, the reasoning we apply to educational institutions applies to any business. It's detailed in Moodle backup: the routine that saves the institution.

If an Attack Happens: The First 72 Hours

Even with all these measures, the risk of ransomware in small businesses never reaches zero. The difference lies in losing a day versus losing a month.

In the First Hours

• Isolate, don't impulsively shut everything down. Remove affected machines from the network (cable and Wi-Fi). Shutting down can erase evidence that helps understand the intrusion.
• Don't delete anything and don't reformat. The ransom note, encrypted files, and logs are evidence.
• Change administrator passwords from a clean machine.
• Confirm the offline backup is intact before starting restoration.

Reporting Obligations

If personal data was accessed with significant risk to data subjects, relevant U.S. state privacy laws typically require notifying affected individuals and, in some cases, state attorneys general or other regulators, promptly. While specific deadlines vary by state, many require notification within a few days of discovery. Smaller entities often have extended deadlines. All incidents, whether reported or not, should be recorded for at least five years. With double extortion, almost every ransomware attack involves personal data.

To Pay or Not to Pay

For ransomware in small businesses, there's no ready answer, but there are facts. Paying does not guarantee data recovery or confidentiality. Sophos reported that the percentage of victims who paid and recovered their data fell to 49%. Coveware noted that the payment rate reached its lowest recorded level in the second quarter of 2026, a sign that more companies are managing to recover without paying. Those with tested offline backups can decide calmly. Those without decide under pressure.

How Agathas Web Solves This

What we most often find when evaluating ransomware risk in small businesses isn't a lack of tools. It's a lack of ownership: no one is responsible for knowing what's exposed, what's outdated, and if the backup works. This is precisely what we deliver in Agathas Web's technology consulting, through our CTO as a Service model.

What's Included

• Exposed surface mapping: what responds from the internet on behalf of your company (VPN, RDP, firewall, websites, email, panels).
• Access review: accounts without MFA, shared accounts, active ex-employee accounts, default passwords on equipment.
• Prioritized remediation plan, in the order of this article, detailing what to do this week, this month, and this quarter, with an estimated effort for each item.
• Backup review with a real restoration test, not just checking a green report.
• One-page incident response plan, including the communication roadmap for regulatory bodies.

How It Works in Practice

We start with a conversation to understand your environment and the real risk of ransomware for small businesses of your size. Then, we conduct a controlled assessment and deliver a report in managerial language, not technical jargon. Execution can be handled by your team, your current vendor, or us: for servers, managed hosting, and the systems we already maintain (Moodle, websites, integrations with the official WhatsApp API), corrections are integrated into our maintenance routine.

How to Engage Our Services

The first step is to schedule a conversation through our consulting page. During this, we assess whether a one-time diagnostic or ongoing monthly support makes sense. For those who have already experienced an incident, the priority shifts: contain, restore, and only then prevent.

Conclusion: Ransomware in Small Businesses is a Priority Problem

The 2026 numbers make it clear that Brazil is on the radar of ransomware groups, and that victims often resemble your company: offices, manufacturing, tech companies, and clinics. The good news is that the entry points are well-known. Credentials without MFA, open remote access, and unpatched equipment account for most cases. None of these items require a multinational corporation's budget.

Close the doors that most facilitate ransomware in small businesses in the correct order, test your backup, and write your incident response plan before you need it. If you don't have someone internally to do this work, contact Agathas Web's consulting team and start with a diagnostic of what's exposed today.