72 Hours to Decide: What Connecticut Small Businesses Need to Know Before a Ransomware Attack Hits

Picture this: it's a Tuesday morning. Your office manager gets to work, opens her computer, and every file on the screen has a new extension she doesn't recognize. A message is waiting. It tells you your files are encrypted. You have 72 hours to pay — usually somewhere between $15,000 and $150,000 in cryptocurrency — or they're gone forever. Oh, and if you contact law enforcement, the price doubles.

This isn't a scene from a thriller. It's a scenario that has played out in Connecticut businesses across every industry — law firms in Hartford, medical offices in Stamford, manufacturing shops in Waterbury, accounting practices in New Haven. Ransomware doesn't care how small you are or how nice your staff is. It's automated, it's scalable, and it's increasingly pointed at businesses that don't have a full IT department to fight back.

Why Small Businesses Are the New Target

There's a persistent myth that cybercriminals go after big fish — hospitals, banks, government agencies. And yes, those attacks happen and make headlines. But sophisticated ransomware groups have figured out something important: small businesses are vastly easier to breach, often have cyber insurance or operating cash they can tap quickly, and are desperate enough to pay because they can't afford days of downtime.

Connecticut's business landscape — dense with professional services, healthcare providers, specialty manufacturers, and regional retailers — is exactly the profile attackers look for. Companies with 5 to 75 employees. Businesses that handle sensitive client data. Operations that can't function without their systems.

According to cybersecurity researchers, the average time between when an attacker first gets into a network and when they launch the actual ransomware encryption is now measured in days or weeks. They're not smashing and grabbing. They're sitting quietly inside your systems, mapping your data, identifying your backups, and waiting for the right moment.

The Real Cost Nobody Talks About

Let's say a Connecticut business gets hit and decides to pay the ransom. That's painful enough. But the ransom is often the smallest part of the total damage.

Downtime. Even after paying and receiving a decryption key — which doesn't always work perfectly — businesses typically face days or weeks of recovery. For a company doing $2 million a year in revenue, even five business days of near-zero productivity is a six-figure problem.

Forensic investigation. You need to know how they got in, what they accessed, and whether they're still in your systems. That requires hiring specialists. It's not cheap.

Regulatory exposure. If your business handles personal health information, financial data, or other protected categories, a ransomware attack may trigger mandatory notification requirements under Connecticut state law or federal regulations. Compliance costs, potential fines, and legal fees add up fast.

Client trust. This one's harder to put a number on. When clients find out their data was potentially exposed — and you often have to tell them — some of them leave. For professional services firms built on confidentiality, that's existential.

Cyber insurance complications. More insurers are scrutinizing claims and denying coverage when they find that basic security practices weren't in place. Paying premiums doesn't guarantee you're covered if you weren't meeting the policy's requirements.

How Attackers Actually Get In

Forget the Hollywood image of hooded hackers typing furiously. Most ransomware attacks start with something embarrassingly mundane.

Phishing emails are still the number one entry point. Someone clicks a link, opens an attachment, or enters credentials on a fake login page. From there, attackers often move laterally through the network using legitimate tools and credentials — which is why basic antivirus software doesn't catch them.

Outdated software and unpatched systems are a close second. Remote Desktop Protocol (RDP) left open to the internet has been the entry point for a significant share of small business attacks. If your team uses remote access tools and those tools aren't properly secured, you may already have uninvited guests.

Vendor and supply chain access is an increasingly common vector, too. Your systems might be fine, but if a vendor or contractor who has access to your network gets compromised, attackers can use that relationship to reach you.

What Connecticut Businesses Are Actually Doing to Protect Themselves

The good news — and there is good news — is that a ransomware attack is not inevitable, and the defenses that work aren't all that complicated. They just require consistency.

The 3-2-1 backup rule, taken seriously. Three copies of your data, on two different types of media, with one stored offsite (or in a truly isolated cloud environment). The critical detail: backups that are connected to your network can be encrypted right along with everything else. Offline or air-gapped backups are what actually save businesses. Several Connecticut companies that survived ransomware attacks in the past two years did so because they had clean backups they could restore from — no ransom required.

Regular restore testing. Having backups isn't enough if you've never verified they actually work. IT teams that run quarterly restore drills know within minutes whether their recovery plan is real or theoretical.

Multi-factor authentication everywhere. MFA on email, remote access, financial systems, and anything else that matters. This single step blocks the vast majority of credential-based attacks.

Employee training that isn't just an annual checkbox. Short, regular phishing simulations and security awareness updates keep people sharp. The goal isn't to punish employees who click — it's to build reflexes over time.

Incident response planning before you need it. Who do you call at 7 a.m. when this happens? Do you have a cybersecurity firm on retainer? Does your cyber insurance policy have a response hotline? Knowing the answers before the attack means you don't lose the first four hours of your 72-hour window figuring out who to call.

The Clock Doesn't Wait

The businesses that come out of ransomware attacks intact — financially and reputationally — share one thing in common: they made decisions about their security posture before the attack, not during it.

The 72-hour countdown is brutal when you're in it. Decisions made under that kind of pressure, with your business operations frozen and attackers on the other end of an encrypted chat, are rarely the right ones.

The preparation window, on the other hand, is wide open right now. Connecticut businesses that take it seriously — even if it means spending a few thousand dollars on better backup infrastructure or a security assessment — are the ones that get to keep their doors open when the message appears on the screen.

Don't wait for your own Tuesday morning to find out which category you're in.