Most cyber attacks on small businesses aren't sophisticated. They don't involve hackers breaking through firewalls with clever code. They involve an email that looks real, a password that was leaked years ago, or a computer that missed its updates.
That's actually good news, because it means most of them can be prevented with sensible, affordable steps. Here are the threats we see most often in Irish businesses, and what you can do about each one.
1. Invoice fraud and fake payment requests
This is the attack that costs Irish businesses money most directly, and it doesn't need any malware at all.
How it works: A criminal sends an email that appears to come from a supplier, a client or your own managing director. It asks for a payment to be made urgently, or says "our bank details have changed". Sometimes the email comes from a lookalike address. Sometimes it comes from the real person's account, because the criminal has broken into their mailbox and has been quietly reading their email for weeks, waiting for the right invoice.
Why it works: The timing, wording and amounts are often exactly right, because they're copied from real conversations.
How to protect your business:
- Never change payment details based on an email alone. Phone the supplier on a number you already have, not one in the email.
- Require two people to approve new payees or changed bank details.
- Set up SPF, DKIM and DMARC on your domain so criminals can't easily send email as you.
- Turn on multi-factor sign-in so a stolen password isn't enough to get into a mailbox.
If you think you've been caught, contact your bank immediately. The faster they act, the better the chance of stopping the payment. Then report it to An Garda Síochána.
2. Phishing emails
Phishing is how most attacks start. An email persuades someone to click a link, open an attachment or type their password into a fake sign-in page.
What's changed: The old tell-tale signs, such as bad spelling, odd formatting and obviously fake senders, are disappearing. Criminals now use AI tools to write well-written, personalised emails in perfect English.
How to protect your business:
- Use email filtering that checks links again at the moment they're clicked, not just when the email arrives.
- Train staff to pause before acting on anything urgent, unexpected or involving money or passwords.
- Run occasional simulated phishing tests so people can practise spotting fakes safely.
- Make it easy and blame-free to report a suspicious email or an accidental click. The sooner you know, the less damage it does.
3. Ransomware
How it works: Malicious software encrypts your files and systems so nothing can be opened, then demands payment for the key. Many attacks now also steal a copy of your data first and threaten to publish it.
Why paying isn't the answer: There's no guarantee you'll get your data back, you may be targeted again, and you'll have funded the criminals. The real defence is being able to recover without them.
How to protect your business:
- Keep backups that are separate from your main systems and can't be encrypted along with everything else.
- Test that you can actually restore from them.
- Use managed antivirus that alerts on mass file encryption, so an attack can be stopped at the first computer.
- Keep Windows and business software up to date.
- Back up Microsoft 365 independently, as well as your computers and servers.
4. Stolen and weak passwords
How it works: Passwords leak when other websites are breached, through phishing, or through malware on a computer. Criminals use automated tools to try them against business email and remote access. Weak or reused passwords make this easy.
How to protect your business:
- Turn on multi-factor sign-in for every user. It's the single most effective protection against stolen passwords.
- Use a password manager so every account has a long, unique password.
- Monitor for your company's email addresses appearing in data breaches.
- Remove accounts for people who have left the business.
A word of warning on multi-factor sign-in: attackers sometimes send repeated approval requests, hoping a tired user will tap "Approve" to make them stop. Tell your staff: if you get a sign-in request you didn't start, deny it and tell IT.
5. AI-powered scams
AI has made criminals more convincing rather than creating entirely new attacks. As well as better-written phishing emails, there are now cloned voices on phone calls and voicemails that sound like a real colleague or director, and fake profiles that impersonate real suppliers.
How to protect your business:
- Agree a simple rule: any request for money, bank details or passwords is checked through a second channel, however convincing it sounds.
- Be wary of urgency and secrecy. "Don't tell anyone, I need this done in the next hour" is a red flag, whoever seems to be asking.
- Use email security that looks for signs of impersonation, not just known bad links.
6. Microsoft 365 and cloud services set up insecurely
Microsoft 365, OneDrive, SharePoint and other cloud tools are secure platforms, but the way they're set up is up to you. Common problems include files shared with "anyone with the link", old accounts that were never removed, admin accounts without multi-factor sign-in, and hidden rules forwarding email to outside addresses.
How to protect your business:
- Review sharing settings and who has access to what.
- Make sure admin accounts are protected and used only for admin tasks.
- Watch for sign-ins from unusual locations and for new forwarding rules.
- Remember that Microsoft keeps the service running, but your data is your responsibility. Back it up.
7. Old computers, software and firewalls
Software that no longer gets security updates, firewalls that haven't been updated in years and remote access left open to the internet are all easy targets. Criminals scan the internet constantly for these weaknesses.
How to protect your business:
- Patch Windows and business software automatically, on a schedule.
- Replace equipment and software that's out of support.
- Use a business-grade firewall and a secure VPN for remote access.
- Have someone check your network setup from the outside.
Five things you can do this week
You don't need technical skills to start:
- Turn on multi-factor sign-in for every email account.
- Agree a "phone to confirm" rule for any change to payment details.
- Check your antivirus is active and up to date on every computer.
- Make sure important files are backed up, and try restoring one.
- Talk to your team about suspicious emails and make reporting easy.
Where to report an incident in Ireland
- Your bank, immediately, for any fraudulent payment.
- An Garda Síochána for fraud and cybercrime.
- The Data Protection Commission, within 72 hours, if a breach involves personal data and is likely to put people at risk.
- The National Cyber Security Centre (NCSC) also publishes guidance and accepts incident reports.
The bottom line
The threats facing small businesses are real, but they mostly rely on the same handful of weaknesses: email, passwords, missing updates and untested backups. Fix those, and you've closed the doors most attackers try first.
How exposed is your business? Take our free cyber risk quiz. Ten yes/no questions, two minutes, and you'll get a score out of 100 with the three gaps to fix first. For a full picture, book a Security Health Check.