I have a standing rant about password security for small businesses. If you have sat in a meeting with me for more than twenty minutes, you have probably heard some version of it. Denmark just gave me the best opening line I’ve had in years.

Earlier this month, the Danish government confirmed that someone got into its Central Register of Persons, the national database that holds the core identity record for nearly every resident. The attacker accessed information on 8.8 million people. The person claiming responsibility says they got in through an account at a small IT company with legitimate access to the registry, and that account’s password was “123456.” Danish newspaper Politiken reported that at least three of the company’s accounts used that same password, including an administrator account.

How a six-digit password reached 8.8 million records

The details are worth a minute of your time. According to documents reported by Danish broadcaster TV 2, the attacker first logged in on September 10 and ran roughly 14 million automated searches over the next ten days. Nobody noticed until October 2.

I keep coming back to how they finally caught it. No security tool flagged it. A staffer at the ministry noticed an invoice showing unusually high activity from the vendor’s account. Someone read a bill.

That vendor, a company called Pays ApS, was authorized to use the registry to validate business customers’ records. Its managing director has confirmed the company’s access was exploited. A small firm held the key to something enormous, and it protected that key with the first six digits on the keyboard.

If you run a professional services firm, that arrangement should feel uncomfortably familiar.

Convenience wins the first round almost every time

I don’t think anyone at that company is stupid. I think someone set up a handful of accounts, needed several people to get into them, picked something everyone could remember, and told themselves they would fix it later. Later never came. I see the same pattern in firms of 50 people and firms of 150.

Humans pick convenience over security by default. Security takes effort, and effort loses to a filing deadline every single time. One weak password is a mistake. Three accounts sharing it, one of them with administrator rights, is a habit, and habits are exactly what attackers count on.

The shared admin password usually exists because sharing access is a real problem. The seasonal hire needs access to the client portal. The office manager needs access to the vendor account while the partner is on vacation. Nobody wants to be the bottleneck for a two-factor code at 8 p.m., so the fix has to make sharing safe. Pretending people won’t share has never worked.

Your vendors hold keys to your data too.

Denmark’s breach did not start inside the government. It started at a vendor. That is the part I want every CFO and managing partner to sit with for a minute.

Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled to 30 percent, while credential abuse remained a leading way attackers got in at 22 percent. Your firm’s data does not just live on your own servers. It lives with your practice management software, your document portal, your payroll provider, and, yes, your IT company. That includes us.

Every one of those relationships involves accounts that someone, somewhere, protects with a password. You are allowed to ask how. Good vendors will answer without getting defensive. A vendor that gets cagey about it has told you something important.

What we do about shared passwords at C2

We have the same sharing problem every firm has, multiplied by every client account we manage. Our answer is a password manager. We use Keeper, which lets us share credentials across the team and attach the second factor to them. In practice, a technician can access the account they need without me texting a password, and without anyone chasing me for a two-factor code.

Every admin account gets its own unique password and multifactor authentication. When someone leaves, their access leaves with them, and we never have to wonder which sticky note they saw. We also want to hear about strange activity long before an invoice arrives. Fourteen million searches should set off an alarm somewhere other than accounts payable.

None of this is exotic. It is the same tooling large companies use, at a price that makes sense for a 75-person firm. Small businesses deserve that, and frankly, so do the people whose records they hold.

One question to ask this week

Send one email to your IT provider and one to the vendor that holds your most sensitive client data. Ask them this: “Does any account with access to our data share a password with another account?”

Suppose the answer comes back fast and clear, great. If it takes a week and a pile of meetings, you have your answer.

Small businesses don’t get targeted by ransomware because they’re interesting. They get targeted because they’re profitable and poorly defended, and attackers do the math the same way any business does.

I’ve said this to clients for years, and I still watch the same disbelief cross their faces. Nobody wants to think a fifty-person accounting firm in Southern California is worth an attacker’s time. The numbers say otherwise, and they’ve been saying so for a while now.

The Numbers Behind Small Business Ransomware Protection

80% of small and midsize business breaches now involve ransomware, compared to 39% at large enterprises, according to Verizon’s 2025 Data Breach Investigations Report.  That difference isn’t random. Larger companies have dedicated security staff, segmented networks, and faster patching. Most small firms have neither the headcount nor the budget for either one, and attackers know it.

Professional services firms specifically, law offices, accounting practices, and consulting firms, became one of the most heavily targeted sectors in ransomware data from the recovery firm Coveware. That tracks with what I see. These firms hold exactly what a ransomware operator wants: clients’ financial records, case files, personal data, and businesses that can’t afford to stay offline during tax season or a court deadline.

It’s Not Personal, and That’s the Point

I tell clients it used to feel personal. Some kid in a basement decides to mess with your business specifically. That’s mostly gone. Now it’s closer to pollution. It’s always pressing in from the outside, looking for a weak point, with no interest in who you are specifically. It just needs one person to click one link, because sending a million emails costs almost nothing and only one has to land.

That shift matters because it changes what “not a target” truly means. Nobody is deciding your firm doesn’t matter enough to attack. Nobody is deciding anything about your firm at all until the attack already worked.

I’ve had clients tell me their business is too boring to bother with, that they don’t have anything a criminal would want. I remind them that a ransomware operator doesn’t care what the business does. They care whether the firm can pay to retrieve its files and whether its defenses are weak enough to be worth the effort. A fifty-person accounting firm during tax season checks both boxes better than almost any target I can think of.

What Reduces Risk

Multi-factor authentication on every account, not just email, closes the door that stolen credentials alone used to open. It’s the single control I push hardest on, because it stops the most common way attackers get in with the least disruption to how your team works.

Endpoint security solutions that actively monitor and respond, not just antivirus software that scans on a schedule, catch the behavior of an attack in progress instead of waiting to recognize a known virus signature. The difference matters because most modern ransomware doesn’t look like the viruses that older antivirus tools were built to catch.

Backups that are tested, not just scheduled, are the difference between a bad week and a business-ending event. I’ve seen firms discover their backups had been silently failing for months, and they only found out during the one week they actually needed to restore something.

Incident response support, meaning an actual written plan for the first hour after something goes wrong, matters more than most firms expect. The firms that recover fastest aren’t the ones with the most expensive tools. They’re the ones who already know who to call, what to shut down first, and who’s authorized to make that call at two in the morning.

What This Costs vs. What an Attack Costs

Every one of these measures costs money and a little bit of friction for your staff. I won’t pretend MFA prompts are fun or that anyone enjoys a tabletop exercise for an incident that hasn’t happened yet.

Weigh that against a ransomware event that takes your firm offline during a filing deadline, a court date, or tax season, and the math stops being close. Most firms that get hit spend more recovering from a single incident than they would have spent on prevention for several years.

If you don’t know where your firm currently stands on any of this, that’s the actual starting point, not buying more software. Start with an honest look at your multi-factor authentication coverage, your backup testing, and whether anyone in your office could answer “what do we do first” if a ransomware alert went off tomorrow.

I walk into a room, and things start working. It happens often enough that my clients have started joking about it, like I’m carrying some kind of charm. I don’t think that’s what’s actually going on. More likely, the equipment was already failing quietly, and I’m just the one who finally noticed.

This came up in a conversation with a colleague around my age, who told me he missed the days when Outlook just worked properly. I asked him to actually think back and tell me what year that was. He got quiet for a second, then admitted it was around 2006. Twenty years felt like yesterday to both of us, which tells you something about how we experience time, but it also missed a bigger point. Outlook has real problems today. The difference is that almost everything else does too, and that isn’t in our heads.

Why Reliability Declined

For a stretch of time around the pandemic, the semiconductor industry took a series of direct hits. In February 2021, a severe winter storm cut power across Texas and forced major chip plants, including facilities run by Samsung and NXP, to shut down for weeks. Forbes covered the disruption in detail as it was unfolding, and the effects rippled outward for years afterward, showing up in everything from laptops to cars.

Manufacturers never fully rebuilt that lost capacity before demand for computers and phones spiked further. On top of that, plenty of companies responded to rising costs by trimming quality wherever customers were least likely to notice right away. A laptop that used to last five years might now last three. A router that once ran quietly in a closet for a decade now needs replacing much sooner. None of this is a conspiracy. It’s a straightforward response to real supply problems, and it happened right as more of our lives moved onto these devices than ever before.

What This Means for You

If your equipment is failing more often than it used to, it probably isn’t because someone in your office is doing something wrong. The hardware itself likely isn’t built to the standard you remember, and that standard isn’t coming back on its own.

The response to that isn’t nostalgia. It’s planning around it. Replace hardware on a schedule instead of waiting for it to die, and treat backups as a routine part of doing business rather than something you scramble for after a crisis. A three- to four-year replacement cycle for laptops and a firm habit of testing your backups, not just running them, will save you more grief than any amount of wishing your equipment behaved the way it did a decade ago. A firm that expects a piece of equipment to eventually fail, and plans for it, loses an afternoon. A firm that assumes everything will keep running the way it did in 2015 loses a great deal more than that.

I still get called in, and things start working again, and I still let the joke about being some kind of charm ride, because it’s funnier than the real explanation. The real explanation is aging equipment paired with a supply chain that still hasn’t fully recovered from a rough couple of years. None of that is mysterious, and none of it is going away on its own, so the businesses doing best right now are the ones planning around it instead of being surprised by it every time.

If your team hasn’t looked at when your hardware was actually purchased, not when it feels like you bought it, that’s a good place to start before your next refresh.

A few years ago, one of my technicians got cornered by a client asking why their internet always seemed to just work. My colleague told her it was the jack fairy. She meant me.

I think about that a lot, because it gets at something people almost never notice about good IT support. When everything works, nobody thinks about how. The internet flows out of the wall, the printer talks to the copier, the phone rings when it’s supposed to. Nobody sees the effort behind any of it. They just see the result, and the result looks like magic.

The Alarm Nobody Could Find

Not long ago, I got called to a client’s office because an alarm was going off and nobody could tell where it was coming from. The only person in the building that day wasn’t a “tech person,” and she didn’t need to be for her job. She took pictures on her phone, trying to describe the sound to me over the phone, and I could hear her starting to panic. I told her I’d be there in a few minutes, since it was on my way anyway.

When I got there, the alarm was buried in a network closet stacked with odds and ends. Boxes, a couple of decorative pieces, nothing that belonged in a server closet. I climbed over and around it all, doubting I’d fit if I were any bigger, until I found the panel and shut it off. She thanked me like I’d performed surgery. All I’d done was know where to look and be willing to climb over some stuff to get there.

What Good IT Support Looks Like

That’s most of what good IT support is. Knowing where things are and understanding how a business runs day-to-day well enough to spot what’s out of place before it turns into an emergency. None of that requires a special gift, just consistent attention, long before anyone calls in a panic.

The part nobody sees is most of the job. A firm with someone quietly monitoring their systems and catching a failing piece of hardware before it dies on a Friday afternoon rarely has a dramatic story to tell. A firm whose IT provider only shows up once something has already broken almost always does, and it’s usually an expensive one. Research from Information Technology Intelligence Consulting, which surveys businesses on exactly this question, has repeatedly found that a large share of small and mid-sized companies put the cost of even a single hour of unplanned downtime in the tens of thousands of dollars. Businesses that never feel that cost aren’t lucky. Someone was paying attention before there was a fire, occasionally a literal one.

Technology Is Just the Excuse

Part of the reason this looks like magic is that my industry does a poor job explaining what we do all day. We talk about firewalls and patch schedules like the details are the point. They rarely are, for the client anyway. The real point is that a law office doesn’t miss a filing deadline because someone moved a copier and forgot to mention it. The real point is that a property manager doesn’t lose an afternoon locked out of a shared drive during a lease signing. Technology is just the excuse. The job is understanding how a business runs and staying a step ahead of whatever might interrupt it.

So next time something at your office quietly works exactly the way it’s supposed to, the printer connects, the email doesn’t crash, resist the urge to call it luck. Ask your IT provider one question instead: what did you do this month that I never had to see? If they can answer that clearly, you’ve found your own jack fairy. If they can’t, you’re probably paying for emergencies instead of prevention, and that’s always the more expensive way to run a business.

Anthropic just published a blog post admitting that one of its Claude models escaped a supposedly sealed test environment and gained unauthorized access to three real companies. My inbox filled up within hours. Clients wanted to know if their AI was about to go rogue.

It isn’t. Read the actual report, and the story is a lot less Terminator and a lot more familiar: someone on the setup side left a door unlocked.

What Anthropic actually found

Anthropic reviewed 141,006 evaluation runs from its cybersecurity testing program, the kind of testing every serious AI lab runs before releasing a model. Out of that entire set, three incidents stood out. In each one, Claude was given a capture-the-flag challenge: find a piece of hidden information on a network and retrieve it, using whatever method works.

Claude was explicitly told that the test environment had no internet access. That statement was wrong. A misconfiguration between Anthropic and a third-party evaluation partner, Irregular, left the machines connected to the real internet. When Claude’s search for the flag led it to real systems, it had no reason to think they weren’t part of the simulation. So it treated them like part of the simulation, and in a handful of cases, it got in.

The techniques involved were not exotic. A weak password here, an exposed debug page there, a missing check on a package registry somewhere else. These are the same causes behind most breaches I’ve dealt with in 35 years of doing this work.

The tell: this was a setup failure, not a rebellion

The detail that matters most is the one getting the least attention in the panicked headlines. This was, in Anthropic’s own words, closer to an operational failure than a model behaving badly on purpose. The model was told a specific thing about its environment. That thing was false. It acted on false information, which is exactly what happens to humans every single day of the week.

There’s also a detail worth sitting with. The three affected companies hadn’t detected the activity themselves. Anthropic found it during an internal review and reached out to them. Their own AI told on itself before their security did.

We’ve seen this movie before, minus the AI

I’ve watched this exact pattern play out in traditional IT breaches for decades. When Kaseya, the platform that powers a huge chunk of the managed services industry, including ours, had a major security incident several years back, the story that circulated afterward was that an intern had made the mistake. Everyone in the industry I talked to at the time had the same reaction: an intern doesn’t have that kind of access unless someone above them set it up that way.

Breaches are rarely the result of some sophisticated actor doing something no one could have anticipated. They happen when a system is configured wrong, a permission is left too open, or a check that should have run didn’t. Anthropic’s incident report reads like every other post-mortem I’ve read in this industry, except that this time the thing exploiting the gap was a language model rather than a person with a laptop.

AI is a chainsaw, not a mind of its own

I tell clients this all the time: AI is as dangerous as a chainsaw. In the right hands, with the right protective equipment, it’s one of the most useful tools you can put in front of a team. Handed to someone in flip-flops with no guard on the blade, it will absolutely take a toe off. The tool didn’t do anything wrong in either case. It did exactly what it was pointed at.

Claude didn’t decide to attack three companies. It was told to find a flag, told the range was sealed, and given no boundary on how to look. When the boundary turned out to be fiction, it kept doing the job it was assigned to do. That’s not a machine developing intent. That’s a machine following instructions built on bad information, at a scale and speed no human could match, which is exactly why the setup around these tools matters more than ever, not less.

What this means if you’re running a business, not a research lab

You don’t have to be evaluating frontier models to have this exposure. If your firm has rolled out AI tools this year, and most professional services firms I work with have, ask yourself whether someone actually configured those tools correctly and wrote down how they’re allowed to be used. That’s the question that matters. Whether the AI itself can be trusted is a much smaller concern by comparison.

I’ve written five AI usage policies for clients in the last two weeks alone. None of them had an incident, but they had never written down what their AI tools are allowed to touch, who’s responsible for checking the output, and what happens when something goes wrong. That gap is where the next headline comes from, and it has nothing to do with the AI misbehaving.

If Anthropic, with a dedicated security team and a third-party evaluation partner, still had a misconfiguration slip through, it’s worth asking what’s sitting unchecked in your own environment right now. Reach out if you need help doing that.

Most professional services firms assume compliance standards apply to somebody else. Then a client sends a security questionnaire before signing a new engagement, or a cyber insurance renewal asks for documentation nobody in the office has seen before.

That is usually the first time compliance readiness for a small business stops being an abstract phrase and turns into a deadline. Accounting practices, law offices, and property management firms handle financial records, personal information, and sometimes payment data every day. That activity puts many of them within the scope of HIPAA, PCI DSS, or SOC 2 requirements, even though no one at the firm set out to become a regulated business.

These firms aren’t careless. Nobody explained which rules actually apply, what those rules require in practice, or where a firm this size should start.

Why Compliance Is Showing Up in More Conversations

Insurance carriers tightened their underwriting standards over the past few years. Cyber liability policies now ask pointed questions about multi-factor authentication, backup testing, and incident response plans before a carrier issues or renews coverage. A firm that can’t answer those questions in writing risks a higher premium or a denied claim.

Clients are asking the same questions. Banks, private equity firms, and larger corporate clients increasingly require a completed security questionnaire or a SOC 2 report before they hand a vendor sensitive data. A law firm handling a corporate client’s litigation, or an accounting firm managing a private equity portfolio company’s books, can lose the engagement over a missing document, not a missing capability.

Professional services firms have also become a bigger target than most owners realize. Ransomware groups shifted their attention toward legal, accounting, and consulting firms, which accounted for close to one in five ransomware attacks in a recent quarter, according to the ransomware recovery firm Coveware. Attackers know these firms hold client financial records, case files, and personal data, and that most run leaner security than hospitals or banks do.

None of this means a fifty-person accounting firm needs a compliance department. It means understanding which standards apply to the business and building a short list of documented practices that satisfy most of what insurers, clients, and auditors ask for.

What HIPAA, PCI, and SOC 2 Actually Cover

HIPAA governs protected health information and applies to healthcare providers, as well as vendors and business partners that handle health data on their behalf. A property management firm running a medical office building, or an accounting practice with healthcare clients who share patient billing data for reconciliation, can find HIPAA obligations attached to work that never looked medical on the surface.

PCI DSS applies to any business that processes, stores, or transmits credit card data. Property management firms collecting rent through an online portal, and law firms accepting card payments for retainers, both fall under PCI requirements the moment a card number touches their systems, even indirectly through a payment processor.

SOC 2 is different from the other two. It isn’t a law. It’s an audit standard that proves an organization has real controls around the security, availability, and confidentiality of data. Firms don’t usually pursue SOC 2 because a regulator demands it. They pursue it because a client, a bank, or an insurer asked for the report, and without it, the deal stalls.

This plays out constantly: an accounting firm picks up outsourced payroll work for a physician client and signs on to keep handling billing reconciliation, then realizes months later that arrangement pulled HIPAA obligations into scope. That kind of realization arrives late more often than it should, usually attached to a deadline.

How to Figure Out Which Ones Apply to You

Start with three questions instead of the full text of each standard.

1. Does the firm handle protected health information, directly or through a client relationship? If yes, HIPAA obligations are worth reviewing with someone who understands both the technology and the legal exposure.
2. Does the firm accept, store, or transmit credit card numbers in any form, including through a client portal or a property management platform? If yes, PCI DSS requirements apply, even at a small scale.
3. Has a client, bank, or insurer ever asked for a completed security questionnaire or a SOC 2 report? If this keeps happening, formal readiness work will save more time than answering the same fifteen-page questionnaire from scratch every quarter.

Most firms find they touch at least one of these standards without ever intending to.

What Readiness Actually Looks Like

Compliance readiness for a fifty- to one hundred fifty-person professional services firm rarely means a five-hundred-page policy binder. It means having documented, working answers to the questions insurers and clients keep asking: multi-factor authentication on every account, tested backups, a written incident response plan, defined access controls, and a basic record of how vendors who touch client data are vetted.

Firms that build these practices once tend to stop dreading every renewal and every new client questionnaire, because the answers already exist. The alternative, scrambling to document controls under deadline pressure, costs more time and usually produces weaker documentation than doing the work upfront.

If you want a structured way to see where your firm stands, our Cyber Liability Insurance Readiness Checklist walks through the eight security categories insurers and compliance frameworks care about most, and shows you exactly where professional services firms typically fall short. Download it, work through it with your team, and you’ll know within an hour which of these standards deserve real attention.