A small construction company was hit by ransomware weeks after its owner declined outside security help, and went out of business within months, according to The Register. The account is a blunt reminder that an old server and a backup connected to it can leave a business with no usable recovery plan.
Watch Desk analysis
What happened
The Register recounts two security incidents described by Dave Hatter, a cybersecurity consultant. In the first, a construction company’s unpatched Windows server held its critical data. Its backup drive was connected to that same server, so the ransomware encrypted both. Hatter said the company could no longer access basic business records, and later went out of business.
In a separate phishing incident, attackers used a convincing Microsoft 365 login page to steal a password and a one-time authentication code. Hatter says his client’s software detected an anomalous login and revoked the attackers’ token within minutes. He recommends phishing-resistant multi-factor authentication, such as hardware security keys or passkeys.
Why it matters
A backup is only a lifeline if an attack cannot reach it too. Keeping copies offline or otherwise separate from the systems they protect, alongside patching servers, can make the difference between restoring operations and losing access to essential records.
The phishing example has a different lesson: a second factor is not automatically a strong defence if a person can be tricked into handing it over. The Register’s account says the attacker relayed the victim’s one-time code in real time. A phishing-resistant key or passkey is designed to make that kind of credential theft harder.
Our read
These are incidents recounted by a consultant, not a survey of how often such failures happen. But the practical advice is refreshingly unglamorous: patch the server, keep a backup out of its reach, and use authentication that cannot simply be typed into a convincing fake page. Security is often a set of small habits; ransomware has a way of marking the homework.
What to watch
- Whether the company’s account of the first incident is independently documented.
- Whether small organisations test that backups can actually be restored.
- Whether more businesses adopt phishing-resistant authentication instead of relying on one-time codes.
Discussion spark: For a small business with limited budget, should the first security investment be an isolated, tested backup or phishing-resistant authentication?
Sources and evidence
- Cheapskates wouldn't pay for security help, got hit by ransomware, and went bust months later – The Register (8 October 2026, 08:15 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.