Ransomware in Ireland: How SMEs Get Targeted BuiltBrilliant

The NIS2 directive’s recitals describe the ransomware reality in plain terms: an exponential increase in attacks, criminal business models like ransomware-as-a-service, and SMEs increasingly targeted because their security is weaker and their position in supply chains makes them leverage. The threat is not hypothetical, and the defences are not exotic.

How the attacks actually happen

Credential reuse. A password leaked from one service unlocks the email, and the email unlocks everything else. MFA on the email is the single highest-value control.
Phishing. A plausible email, a clicked link, and a session token stolen, no malware required.
Unpatched software. The PHP flaw pattern is the template: disclosure, automated exploitation within hours, victims by the thousands.
Supply chain leverage. The attacker hits the SME not for its own data but to move into the larger customers it serves, the exact dynamic NIS2 describes.

The controls that stop it

MFA everywhere, email first, per the security checklist.
Automatic patching, daily, with the migration path for platforms that cannot, the WordPress migration guide.
Immutable backups, because ransomware deletes your backups before it shows you the ransom note, the rule from our backup guide.
Least privilege, so a compromised account cannot reach everything, the cloud IAM discipline.
A response plan, with names, because the 72-hour GDPR breach clock starts before the dust settles.

The uncomfortable truth

Attackers automate, so they do not care whether you are small. They care whether you are easy. The businesses that implement the five controls stop being easy, and the attackers move on to someone who is not.