One Recycled Password. Four Quiet Days. Then the Ransom Note.

Eight months ago, one of the partners signed up for a golf club's booking site using the same password she uses for her work email. Last spring that booking site was breached. Her email and password went into a file that's been sold and resold ever since. She never heard about it. Nobody at the firm did.

This is how most ransomware stories actually start. Not with a genius. With a password.

Someone tries her email and password on the firm's remote-access login. It works. There's no second step, no code sent to her phone, because multi-factor authentication was "on the list" for next quarter.

That gap is common. In Sophos's 2025 Active Adversary Report, covering incidents it handled in 2024, compromised credentials were the top root cause, at 41%, and 63% of cases lacked multi-factor authentication.

They don't encrypt anything right away. They look around first. In the ransomware cases Sophos's incident responders handled in 2024, the median attacker was inside for about four days before launching the attack, and the median time from first access to taking over Active Directory (the system that controls every account in the office) was about 11 hours.

In our composite, those four days go like this:

• Map the network: which server holds client files, where the accounting data lives, who has admin rights
• Take over an admin account so every door opens
• Find the backups and delete them, or encrypt them first
• Copy client tax files and financial records out to a server the attacker controls
• Wait for a quiet night

Nobody sees any of it, because nobody's watching. The IT provider gets alerts by email, and the email is a Monday problem.

Staff arrive to the same screen on every computer:

• ✕Email: locked
• ✕Practice management and client files: locked
• ✕Accounting software: locked
• ✕Last night's backup: deleted

This is the part of the story that's most typical. Ransomware was involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report, and Verizon's 2025 report found it in 88% of breaches at small and mid-sized businesses, against 39% at large ones. It's not a big-company problem. It's an everybody-without-a-security-team problem.

Say the firm refuses to pay. Most victims do: Verizon found 69% of ransomware victims didn't pay. For those who did, the median payment was US$139,875.

Not paying doesn't make it free. The firm now has:

• Days to weeks with no email, no files and no billing, in the middle of tax season
• Outside forensics and recovery fees
• Privacy obligations. In Canada, under PIPEDA, a breach that creates a real risk of significant harm has to be reported to the Privacy Commissioner, and affected clients notified as soon as feasible; records of every breach must be kept for two years. In the U.S., every state has its own breach-notification law, and a tax preparer covered by the FTC Safeguards Rule has to tell the FTC within 30 days if 500 or more people are affected.
• Phone calls to every client explaining why their tax file might be on the internet
• The clients who quietly don't come back

We won't put a single dollar figure on that. It depends on the firm, and anyone who gives you a precise number for a story like this is making it up. What we can say is that for most small firms, it's far more than the cost of the two controls below.

• ✓Multi-factor authentication on every remote login and mailbox. The stolen password gets the attacker to a prompt for a code on the partner's phone, and no further. This one control breaks the story on day zero.
• ✓Monitoring someone actually watches. Tools that flag an admin login at midnight, a new admin account, or backups being deleted. In our composite, there were four days of warning signs. Somebody just had to be looking.

Two habits close the gap that let the password leak in the first place:

• ✓A password manager and a no-reuse rule. Work passwords are never used anywhere else.
• ✓Checking for leaked staff credentials. Breach databases can be searched for your company email addresses, and anything exposed gets reset before someone else tries it.

And one more, for the day something gets through anyway: keep one backup copy offline, and test a restore on a schedule. A backup you've never restored is a hope, not a plan.

A QLIA Cyber Intelligence audit looks for exactly the gaps in this story. We map every system you have facing the internet, check which logins have multi-factor authentication and which don't, search breach data for your staff's leaked credentials, review how your backups are set up, and give you a prioritized fix plan in plain English.

That's the uncomfortable part. Most small-business breaches don't need a clever attacker. They need a password from somewhere else and a door with no second lock.

Your first security audit with QLIA is free. If we don't find vulnerabilities, it stays free, with no invoice and no pressure to buy anything. If we do find gaps, you get a prioritized fix plan and decide what happens next. Critical findings come in 7 to 10 days, and the full report in 14.