Saturday Brief — How to Kill a $2M Company in Four Characters

☕ SATURDAY INTELLIGENCE BRIEF

The Weekly "How Did That Even Happen?" File

HOW TO KILL A $2 MILLION COMPANY IN FOUR CHARACTERS

admin/admin.

That's it. That's the whole security strategy. A manufacturing firm — profitable, 30 employees, two good decades — got ransomwared last fall because their network storage device was still running the credentials that shipped in the box. Not a sophisticated zero-day. Not a nation-state actor. A bot. Scanning the internet. Looking for exactly this level of ambition.

The attackers encrypted everything in eleven minutes.

Backups? Same network. Of course. Why would you put backups somewhere inconvenient? That would require planning, and planning would require admitting you're a target, and admitting you're a target would require spending money, and spending money would require a conversation with the owner, and the owner was busy. For five years.

Cyber insurance? They'd dropped the rider to save $4,200 a year. Annual savings: $4,200. Annual consequences: $340,000 in recovery costs they couldn't afford, 30 people without jobs, and a building that's now listed with a business broker instead of an IT firm.

For context: $4,200 is roughly what this company spent on break room coffee. They valued Keurig pods more than data security. The attackers valued their data at $340,000. Someone miscalculated.

THE PART THAT SHOULD MAKE YOU UNCOMFORTABLE:

This isn't rare. This is the median outcome.

88% of SMB breaches last year involved ransomware. 65% of SMBs don't use multi-factor authentication — the thing that takes 45 seconds to set up and blocks 99.9% of automated attacks. Only 11% use any AI-powered defense. The average SMB has better protection on their Instagram account than their production database.

The attackers aren't talented. They're just patient. And they start every scan with admin/admin, because it works more often than it should.

IF YOU SELL CYBERSECURITY: This story isn't a scare tactic. It's a Tuesday. You have prospects right now running default credentials on internet-facing devices. We can tell you which ones.

IF YOU BROKER BUSINESSES: The next deal you value, ask one question — "who manages your network credentials?" If the answer is a shrug, discount accordingly.

IF YOU BUY BUSINESSES: "Has this company had a security audit in the last two years?" is the new "are the books clean?" If they can't answer both, walk.

Have a good weekend. For the love of everything, change your passwords.

— Monadnock Cyber | Intelligence & Analysis

monadnockcyber.ai

#SaturdayBrief #CyberIntelligence #DontBeThisCompany