The attack is the cheap part
We’ve watched this pattern play out with small healthcare practices and businesses across the region. Attackers strike when no one is watching – nights, weekends, holidays. They encrypt the server running the entire operation. Traditional antivirus never makes a sound, because modern attackers are built to walk right past it.
The local IT provider restores from backup. A few stressful days, some overtime, and the business is running again. Total visible cost: maybe a few thousand dollars. Then the email or letter arrives.
When your vendors stop trusting your network
Here’s what’s changed in the last few years: your business partners no longer take your word for it that the hackers are gone. Healthcare clearinghouses, payment processors, insurance carriers, and enterprise customers increasingly respond to a breach at a partner business the same way – they cut the connection.
And they won’t restore it until an independent digital forensics and incident response (DFIR) firm does all of the following:
- A full forensic investigation of the entire network – every server, workstation, and cloud system, not just the machine that was hit.
- A monitoring period, often three months, with the forensic firm’s own eyes on your network through a deployed EDR (endpoint detection and response) platform.
- And finally, a signed written attestation that your environment is clean, including the last date of any detected unauthorized activity.
This isn’t a suggestion. Until it’s done, the connection stays off – which for a medical practice can mean claims don’t flow, and for any business can mean revenue stops.
The market rate for this kind of engagement? Typically, $25,000 to $50,000 for a small business network. That’s on top of what was already spent getting the servers running again, and before the cyber insurance premium increase that follows a claim.
The question that can’t be answered
There’s an even worse outcome than the bill, and it’s this sentence from the forensic firm:
“We can’t determine what the attackers took.”
Forensic investigators work with evidence: system logs, firewall logs, memory images, disk artifacts. If a business had no logging, no EDR, and no monitoring in place before the attack – and if the compromised systems were wiped and rebuilt during recovery instead of preserved – that evidence may simply not exist.
For a healthcare practice, that’s not just frustrating. Under HIPAA, when patient data may have been accessed and you can’t prove it wasn’t, you may be facing breach notification obligations, regulatory scrutiny, and legal costs – all because the question “what did they take?” became unanswerable the moment the server was wiped.
This is also why what your IT provider does in the first hours after discovering an attack matters enormously. Preserving forensic evidence – disk images, logs, even the encrypted backup sets – before rebuilding can be the difference between a clear answer and a permanent question mark.
Hackers make return visits
One more uncomfortable truth: getting hit once makes you more likely to get hit again, not less.
Industry research consistently shows attackers returning to organizations they’ve previously breached – the vulnerability that let them in the first time usually still exists, and they know the floor plan now. Restoring from backup puts your data back. It does not close the door the attackers used.
An ounce of prevention, priced in dollars
Benjamin Franklin said it in 1735, talking about fire prevention: “An ounce of prevention is worth a pound of cure.” In cybersecurity, the exchange rate is even more lopsided.
Modern managed detection and response – 24/7 monitoring, EDR on every endpoint, immutable backups, multifactor authentication on all remote access – costs a small business a modest, predictable monthly amount. The cure, as we’ve just walked through, starts in the tens of thousands and comes bundled with weeks of lost revenue and questions that may never get answered.
And prevention pays off twice. If an incident does happen despite every safeguard – because in this business it’s when, not if – a monitored network means the evidence exists.
- The forensic questions get answered in days instead of never.
- The vendor attestation gets signed instead of stalled.
- The HIPAA analysis has facts to work with instead of assumptions.
What “too small to be a target” really means
Small businesses and medical practices often assume attackers only chase big companies. The opposite is true: attackers deliberately target small organizations because they expect exactly the setup described above – one server running everything, aging antivirus, no monitoring, no logs, and an owner who believes they’re too small to matter.
You’re not too small to be a target. You’re the preferred target.
Know what your business could prove
Here’s the question we’d encourage every practice owner and small business operator to ask: if an attacker got in tonight, what would you be able to prove tomorrow? What was accessed, when they got in, what they touched, whether patient or customer data left the building?
If the honest answer is “nothing,” that’s fixable – and fixing it costs a fraction of finding out the hard way.
Digital Plains provides managed IT and cybersecurity services for small businesses and healthcare practices in Fargo, West Fargo, Moorhead, and across North Dakota and Minnesota. We’ll review where your business stands – what’s protected, what’s exposed, and what it would take to close the gaps – at no cost and no pressure.
Call 701.929.9405 or schedule your security review here
