Photo by Crosby Hinze on Unsplash
A car dealership. Not a bank. Not a hospital. Not a government department. A business that sells cars, keeps customer records, processes finance applications, and relies on booking systems to get through the working week. And yet that was enough to attract a ransomware group who encrypted their systems and posted stolen data online for the world to see.
This is not a one-off. Ransomware groups have quietly shifted their targeting over the past few years. The large, headline-grabbing attacks on critical infrastructure still happen, but the bulk of the activity has moved towards businesses that look completely ordinary from the outside. Dealerships, accountancy practices, solicitors, letting agents, small manufacturers, dental practices. Any business that holds data, processes payments, and does not have a full-time security team watching the network.
Why ordinary businesses are the target now
The logic is straightforward once you see it. Large organisations have dedicated security teams, incident response plans, and cyber insurance with demanding technical requirements attached. They are harder to breach, and even when ransomware lands, recovery is faster because the resources are there. Small businesses typically have none of that. A ransomware group does not need a sophisticated way in. A phishing email that a staff member clicks on a Monday morning is often enough.
Car dealerships sit in an interesting position from a data perspective. They hold customer names, addresses, and contact details. They process finance applications with income information attached. They store vehicle registration records linked to real people. They use stock management and booking systems that, when taken offline, stop the business from functioning almost immediately. That combination of personal data and operational dependency is exactly what ransomware groups look for.
What actually happens when ransomware hits a small business
Files get encrypted, the business grinds to a halt, and then comes the demand. Pay the ransom and you might get a decryption key. Might. There is no guarantee, and there are good reasons not to pay even when the financial pressure to do so feels overwhelming.
Modern ransomware groups add a second layer called double extortion. Before encrypting the files, they copy them. So even if you restore from backup, the threat does not go away. Pay, or the data gets published. Customer records. Finance documents. Confidential correspondence. The reputational and legal exposure from that kind of data going public is significant for any business that holds personal data under UK GDPR.
The controls that actually reduce your exposure
There is no single product that makes ransomware impossible. Anyone who tells you otherwise is overselling. But there are layers of protection that, working together, make it substantially harder for an attack to land and dramatically easier to recover if one does get through.
Endpoint protection that watches behaviour, not just known threats. Traditional antivirus looks for known malware signatures. Modern ransomware is written to bypass that. Ransomware-specific protection watches for the behaviour patterns that indicate encryption activity is starting and can stop the process before significant damage is done.
Backups that ransomware cannot reach. Most businesses have backups. Most ransomware groups know that, and they spend time inside a network identifying and destroying backups before they trigger the encryption. A backup sitting on the same network as your main systems is not enough. Backups need to be isolated, tested regularly, and structured so that no single compromised credential can wipe them out.
Patching that actually happens on schedule. Many ransomware attacks start with a known vulnerability in an unpatched system. The fix already existed. Nobody had applied it. Automated, managed patching removes that gap without relying on someone remembering to run updates manually.
Staff who recognise what a suspicious email looks like. The phishing email remains the most common way ransomware gets into a business. A member of staff who knows what to look for, and who feels safe reporting something rather than just deleting it, is one of the most cost-effective defences a small business can have. Security awareness training is not a one-off video. It is the kind of repeated, practical habit-building that actually changes behaviour over time.
If you want to know where you actually stand
Most small businesses do not know how exposed they are until something goes wrong. A ransomware attack is a very difficult time to find that out. A better approach is to understand your current gaps before an attacker does. The right backup and recovery setup, combined with endpoint protection and staff who know what to watch for, gives you something real to stand on if the worst happens.
The car dealership in this story was not doing anything unusual. They were running a business. That was enough to make them a target. The businesses that come through ransomware incidents with the least damage are the ones that had already made it difficult to land an attack and had a recovery plan that worked when they tested it. That is a reachable position for most UK small businesses, and it does not require a large IT team to get there.