Saturday Brief — How to Kill a $2M Company in Four Characters

☕ SATURDAY INTELLIGENCE BRIEF

The Weekly "How Did That Even Happen?" File

HOW TO KILL A $2 MILLION COMPANY IN FOUR CHARACTERS

admin/admin.

That's it. That's the whole security strategy. A manufacturing firm — profitable, 30 employees, two good decades — got ransomwared last fall because their network storage device was still running the credentials that shipped in the box. Not a sophisticated zero-day. Not a nation-state actor. A bot. Scanning the internet. Looking for exactly this level of ambition.

The attackers encrypted everything in eleven minutes.

Backups? Same network. Of course. Why would you put backups somewhere inconvenient? That would require planning, and planning would require admitting you're a target, and admitting you're a target would require spending money, and spending money would require a conversation with the owner, and the owner was busy. For five years.

Cyber insurance? They'd dropped the rider to save $4,200 a year. Annual savings: $4,200. Annual consequences: $340,000 in recovery costs they couldn't afford, 30 people without jobs, and a building that's now listed with a business broker instead of an IT firm.

For context: $4,200 is roughly what this company spent on break room coffee. They valued Keurig pods more than data security. The attackers valued their data at $340,000. Someone miscalculated.

THE PART THAT SHOULD MAKE YOU UNCOMFORTABLE:

This isn't rare. This is the median outcome.

88% of SMB breaches last year involved ransomware. 65% of SMBs don't use multi-factor authentication — the thing that takes 45 seconds to set up and blocks 99.9% of automated attacks. Only 11% use any AI-powered defense. The average SMB has better protection on their Instagram account than their production database.

The attackers aren't talented. They're just patient. And they start every scan with admin/admin, because it works more often than it should.

IF YOU SELL CYBERSECURITY: This story isn't a scare tactic. It's a Tuesday. You have prospects right now running default credentials on internet-facing devices. We can tell you which ones.

IF YOU BROKER BUSINESSES: The next deal you value, ask one question — "who manages your network credentials?" If the answer is a shrug, discount accordingly.

IF YOU BUY BUSINESSES: "Has this company had a security audit in the last two years?" is the new "are the books clean?" If they can't answer both, walk.

Have a good weekend. For the love of everything, change your passwords.

— Monadnock Cyber | Intelligence & Analysis

monadnockcyber.ai

#SaturdayBrief #CyberIntelligence #DontBeThisCompany

Saturday Intelligence Brief: How a $2M Business Died Because Nobody Changed the Default Password

☕ SATURDAY INTELLIGENCE BRIEF

The Weekly "How Did That Even Happen?" File

HOW A $2M BUSINESS DIED BECAUSE NOBODY CHANGED THE DEFAULT PASSWORD

A manufacturing firm in the Northeast — profitable, 30 employees, two decades in business — got hit with ransomware last fall. The entry point? Their network-attached storage device still had the factory login: admin/admin.

Not admin/P@ssw0rd123. Not admin/companyname2024. Just admin/admin. The same credentials printed on page 3 of the setup guide that nobody read in 2019.

The attackers encrypted everything. Backups? On the same network. Insurance? They'd let the cyber rider lapse to save $4,200 a year. Recovery estimate? $340,000. The owner looked at the numbers, looked at the building, and called a business broker instead of an IT firm.

Thirty employees found out on a Monday.

LESSON FOR THE INTELLIGENCE COMMUNITY

Every business that fails this way had the same three things in common — they knew they should update their security, they planned to do it "next quarter," and they assumed they were too small to be a target.

They weren't too small. They were too easy.

88% of SMB breaches last year involved ransomware. 65% of SMBs still don't use multi-factor authentication. The attackers aren't sophisticated — they're just persistent, and they start with the default credentials.

If you sell cybersecurity services: this story is your opening line.
If you sell businesses: this is why you check the cyber liability exposure before you set the asking price.
If you buy businesses: this is the due diligence question nobody asks until it's the only question that matters.

"When was the last time someone audited your network credentials?"

If the answer involves a pause longer than three seconds, you have your next conversation.

Have a good weekend. Change your passwords.

— Monadnock Cyber | Intelligence & Analysis
monadnockcyber.ai