Yes: ransomware attacks on small and mid-sized businesses climbed sharply through 2026, and Southwest Florida companies are not shielded from that trend just because they aren’t a household name. Two rival ransomware crews, Qilin and a newer outfit called The Gentlemen, are racing to claim victims, and both increasingly go after companies with a few dozen employees rather than hardened enterprises with dedicated security teams. If your business runs on QuickBooks, a shared drive, and a handful of cloud logins, you fit the profile these groups are built to hit.
- Ransomware disclosures rose from 6,046 to 7,551 victims worldwide in the year ending March 2026, a 24.9% increase, according to Black Kite’s 2026 Ransomware Report.
- Qilin alone grew from 250 to 1,358 claimed victims over that same year, a 443% jump, and now accounts for roughly one in five to six ransomware victims tracked globally.
- Business email compromise cost U.S. companies $3.04 billion in 2025, up from $2.77 billion in 2024, according to the FBI’s 2025 Internet Crime Report.
- Mid-market companies, not the largest enterprises, saw the fastest-growing share of ransomware victims in the same Black Kite dataset.
- Patching known software flaws and requiring multi-factor authentication on email and remote access still stop most of these attacks before they start.
Why are ransomware gangs targeting small businesses in 2026?
Money and math. A hospital system or a bank has a security team watching its network around the clock. A 20-person accounting firm in Fort Myers usually has neither, but it still has bank access and client data, plus a strong incentive to pay quickly to get back online. Attackers have noticed. Qilin’s recent victim list includes local courts, school districts, healthcare practices, and water utilities, organizations that can’t absorb extended downtime but also can’t afford enterprise-grade defenses.
The rivalry between Qilin and The Gentlemen adds to the pressure. When two ransomware operations compete for the same pool of victims, both tend to widen their targeting to keep volume up, pulling smaller companies into range. Neither group needs a sophisticated exploit to get in. Most intrusions still start with a phished password, an exposed remote desktop connection, or a vendor account nobody remembered to remove.
What is business email compromise actually costing companies like yours?
Ransomware gets the headlines, but business email compromise, where an attacker impersonates a vendor or executive to redirect a wire transfer, remains one of the most expensive crime categories the FBI tracks. The bureau’s 2025 Internet Crime Report puts BEC losses at $3.04 billion for the year, most of it moved by wire transfer or ACH, which is difficult to claw back once it clears. For a Naples or Tampa business, that usually plays out as a single fraudulent invoice payment or payroll redirect. It’s a five-minute email that looks routine until the money is gone.
The defense here has little to do with expensive software. It’s a callback policy: any request to change a bank account, wire amount, or payroll deposit gets confirmed by phone, using a number you already have on file, not one in the email.
What should a Southwest Florida small business do about it this quarter?
Start with the basics that actually move the needle, in this order:
- Turn on multi-factor authentication for email, VPN, and any remote access tool, and make it mandatory, not optional, for owners and executives.
- Patch internet-facing systems and remote desktop software on a schedule measured in days, not months.
- Test your backups by actually restoring a file or a server, not just confirming the backup job ran. If ransomware hits and your backup won’t restore, you’re back to negotiating with the attacker anyway. Our guide to backup and disaster recovery for Southwest Florida small businesses walks through what a tested recovery plan looks like in practice.
- Review vendor and former-employee access quarterly. Old accounts left active after a contract ends are a common entry point.
If you carry cyber liability insurance, or are shopping for it, insurers now expect proof that these controls exist, not just a checkbox on an application. Our post on qualifying for and keeping cyber insurance in 2026 covers what underwriters are asking to see before they’ll bind or renew a policy.
Does hurricane season change any of this?
It adds pressure at the worst possible time. A ransomware recovery already means running your business without normal systems for days. If that happens during or right after a storm, with staff displaced and internet service spotty, the outage stretches longer and costs more. Businesses with offsite backups and a documented recovery plan in place before storm season peaks in August and September are in a far better spot than those improvising a cyberattack recovery and a storm recovery at once.
Frequently asked questions
Is ransomware really more of a threat to small businesses than to large companies now?
Not more of a threat in absolute terms, but small and mid-sized companies now make up a large share of victims because they combine valuable data with weaker defenses. Black Kite’s 2026 report found the fastest growth in victim share among mid-market companies, not the largest enterprises.
What’s the single most cost-effective step we can take right now?
Multi-factor authentication on email and remote access. It’s inexpensive, quick to roll out, and blocks the most common entry method attackers use.
How is business email compromise different from ransomware?
Ransomware encrypts your systems and demands payment to unlock them. Business email compromise tricks someone into sending money or data to an attacker posing as a trusted contact. Both rely on the same weak point: a compromised or convincingly spoofed account.
Should we pay a ransom if we get hit?
Law enforcement generally advises against it, since payment doesn’t guarantee your data is returned or that you won’t be targeted again, and it funds further attacks. A tested backup and recovery plan is what actually removes that decision from the table.
If you’re not sure where your business stands on multi-factor authentication, patching, or backup testing, we’ll tell you plainly in a free 15-minute IT and security review. No sales pitch, just a look at what’s exposed and what to fix first. Get in touch to schedule one.
Southwest Florida IT (SWFIT)
