The Michigan businesses getting hit by ransomware are not the ones you read about nationally. They are 30-person law firms, dental practices, auto suppliers, and property management companies. Ordinary places with valuable data and one open door nobody noticed.
Ransomware protection for Michigan businesses is not a product you buy once. It is a handful of unglamorous habits layered together: filtered email, second-factor logins, patched software, and backups somebody has actually tested. This article covers what each layer does, how to check where you stand today, and the one thing most businesses get wrong about their backups.
In this article
No business is unhackable, and anyone selling you that is selling something. The goal is simpler: be a harder target than the business next door.
Why Michigan businesses end up on the list
Attackers are opportunists, not masterminds. They scan for what is easy, and Michigan's mix of manufacturing, professional services, and healthcare gives them plenty of reasons to look here. Auto suppliers hold contracts and production schedules. Law firms hold client files. Dental and medical practices hold patient records. All of it is worth money to somebody.
Smaller companies get targeted specifically because attackers expect thinner defenses and no full-time security staff. That assumption is often wrong, and proving it wrong does not take an enterprise budget. It takes the basics, done consistently.
How ransomware actually gets in
Almost every incident we have looked at traces back to one of three things. None of them involve movie-grade hacking.
| Entry point | What it looks like in real life |
|---|---|
| Phishing email | A message that looks like a client, a vendor invoice, or a Microsoft login page. One click, one entered password, and someone else is inside. |
| Stolen credentials | A password reused from a personal account that got breached years ago, or a remote access login that never had a second factor on it. |
| Unpatched software | A known flaw in a firewall, server or business application that had a fix available months ago and never got applied. |
Here is the pattern that surprises people. Attackers rarely encrypt anything on day one. They get in quietly, look around for a week or two, find the backups, and encrypt those first. The ransom note only shows up once they are confident you have no easy way back. If you want a first-hand version of how convincing the initial email can be, our marketing lead wrote up the Microsoft 365 phishing attempt he clicked on.
Ransomware protection for Michigan businesses: the layers that matter
No single tool stops ransomware. What works is layers, where each one catches what the one before it missed. Here is what a practical stack looks like for a business with 15 to 100 people.
Email filtering that reads intent
Beyond spam filtering. Modern tools check links, spot impersonation, and quarantine attachments before anyone can click them. This is the layer that stops the most attempts.
Multi-factor authentication everywhere
Email, remote access, and every cloud app. A stolen password stops being useful the moment a second factor is required. It is the cheapest meaningful improvement most businesses can make this week.
Endpoint detection on every device
Traditional antivirus looks for known files. Endpoint detection watches behavior and can isolate a laptop mid-attack before it reaches the server. Part of our managed security coverage.
Patching on a real schedule
Operating systems, applications, firewalls and switches, updated on a cycle rather than whenever someone remembers. Included as standard in managed IT services.
Backups the attacker cannot reach
At least one copy off the network, ideally immutable so it cannot be altered or deleted. This is the layer that decides whether an incident is a bad week or a business-ending event.
Training people actually remember
Short, realistic, and repeated. Not an annual slideshow. The goal is that someone pauses on a suspicious invoice instead of forwarding it to accounting.
Score your ransomware readiness
Seven things we check first on any new client. Tap what you already have in place. Nothing is saved or sent anywhere.
Start with the basics
Pick the ones you know are in place. Guessing does not help you.
// A quick self-check, not an audit. The gaps most businesses miss are the ones they assumed were covered.
Having a backup is not the same as knowing you can restore
This is the gap we find most often, and it is almost always in a business that believes it is covered. The backup software reports success every night. The dashboard is green. Nobody has pulled anything back from it in two years.
A backup job completing tells you data was written somewhere. It does not tell you the data is complete, that it is readable, that the right systems are included, or how long a full restore would actually take on a Tuesday morning with everyone standing around waiting.
The job ran
- Data was copied somewhere last night
- No error was reported by the software
- Storage had room for it
You can actually come back
- The files open, and they are the current version
- Your critical applications are included, not just file shares
- You know how many hours a full recovery takes
- The backup copy survived being isolated from the network
What a real backup test looks like
- Restore something real, quarterly. Not a test file. Pull back a live document or a database and confirm it opens and is current.
- Time it. If a full recovery takes 40 hours and your business can absorb 8, you have a plan problem, not a backup problem.
- Check what is included. Plenty of businesses back up file servers and quietly leave out the line-of-business application everyone actually works in.
- Confirm one copy is out of reach. If ransomware can encrypt your backup because it sits on the same network with the same credentials, it is not a backup. It is another target.
- Write down who does the restore. During an incident is a bad time to discover the only person who knew the process left last year.
This is exactly what managed backup is for. We monitor backup health, flag failures the same day, and run restore checks so the answer to "can we come back from this" is known before anyone needs it. The wider backup and recovery side covers the plan around it: what comes back first, and how fast.
What an attack actually costs
The ransom is rarely the biggest number. Downtime is. Add recovery labor, legal and notification requirements, staff sitting idle, and clients who quietly go elsewhere. IBM's Cost of a Data Breach report is a reasonable benchmark for how quickly those pieces stack up.
Michigan businesses may also carry notification obligations depending on the data involved. Healthcare, legal and financial firms usually have the most to work through, which is a good argument for sorting out the response plan while nothing is on fire.
And paying rarely solves it. Payment does not guarantee a clean recovery, and it marks the business as one that pays. Tested backups give you the option to say no.
Most of the businesses we meet are not behind because they do not care about security. They are behind because nobody ever gave them a plain-English picture of where they stand. That is usually step one. An honest look at what is in place and what is missing.
Questions business owners ask us
01How do most ransomware attacks on small businesses start?
With something ordinary. A convincing email, a password reused from a breached personal account, or software that never got patched. Phishing is usually the first door attackers try, because one click can give them a path into everything else.
02How do I know if our backups would actually work?
Test a restore. Pull back a real file or database and confirm it opens and is current, then time how long a full recovery would take. A backup job reporting success only means data was written. It does not prove you can come back from it.
03Should we just pay the ransom if we get hit?
Rarely the right move. Payment does not guarantee full recovery, and it flags the business as one that pays. The better investment is prevention, tested backups, and a response plan that gives you options before panic sets in.
04What is the single most useful thing we can do this month?
Two things, and neither is expensive. Turn on multi-factor authentication everywhere it is missing, and run one honest restore test. Those two close the widest gaps we see in Metro Detroit businesses.
The short version
- Attackers pick targets by ease, not size. Local professional services and manufacturing hold data worth taking.
- Nearly every incident starts with phishing, a stolen password, or an unpatched system.
- Layers beat products. Filtering, MFA, endpoint detection, patching, backups and training together.
- A green backup light is not proof of anything. A tested restore is.
- You do not need perfect security. You need to be harder to hit than the business next door.
Related reading: a real Microsoft 365 phishing attempt, and why it worked.
Want an honest read on where you stand?
We will walk your setup layer by layer, tell you what is covered, what is not, and what to fix first. Plain English, no pressure, no scare tactics.
Request a Security Review We'll Take IT From Here.