Why would hackers target a small plumbing or HVAC company?

Because you are easier and you still pay. Attacks are automated and indiscriminate — they scan for weak credentials, not for famous names. A contractor holds customer addresses, card details and payroll data, and usually has no IT staff, which is precisely the combination attackers look for.

What is the fastest thing I can do to protect my business today?

Turn on multi-factor authentication for email and banking, and stop reusing passwords. Those two changes block the overwhelming majority of real-world attacks and take about ten minutes. Everything else is worth doing, but nothing else has that ratio of effort to protection.

What is the 3-2-1 backup rule?

Three copies of your data, on two different types of storage, with one copy kept off-site. It is the reason ransomware becomes an inconvenience instead of a business-ending event: if you can restore from a clean copy, there is nothing to negotiate over.

Is cyber insurance worth it for a small contractor?

Usually yes, but read what it requires. Most policies now expect basic controls — MFA, backups, staff training — to be in place, and a claim can be denied if they are not. Treat the policy as a backstop for the basics, not a substitute for them.

Legal & Compliance

Cybersecurity for Plumbers: Protecting Your Business from Ransomware

Moil Team · 9 min read · Published 2025-12-18

Hackers aren't targeting Google; they are targeting you. Why small trades are the new #1 target and how to lock your digital doors.

Cybersecurity for Plumbers: Protecting Your Business from Ransomware

Why Hackers Target Small Contractors

The assumption that "I'm too small to hack" is dangerous. Small businesses are now the #1 target because they have money, valuable customer data (including home entry codes and credit cards), and typically weak security. 43% of all cyber attacks now target SMBs, and 60% of those businesses close within 6 months of a major breach.

The 5 Real Threats Facing Contractors

1. Ransomware: Hackers lock your job schedules and financial records, demanding $5k–$30k for the key. Loss: Total business shutdown.
2. Phishing: Emails pretending to be Home Depot or your bank to steal login info. One click on a fake invoice can compromise your accounts.
3. BEC (Business Email Compromise): A hacker watches your emails for weeks, then tells your bookkeeper to change the bank deposit for a large job. Average loss: $100,000.
4. Data Breaches: Customer names and addresses are exposed. 2026 laws impose fines up to $7,500 PER RECORD in some states.
5. Smart Device Hacks: Compromised shop security cameras or smart van locks allow physical theft.

The 10-Minute Security Basics (Do These NOW)

1. Enable Two-Factor Authentication (2FA)

Require a code from your phone to log in to email, banking, and QuickBooks. This blocks 99% of unauthorized access. Use apps like Google Authenticator or Authy instead of SMS.

2. Use a Password Manager

Stop using "Plumbing123". Tools like 1Password ($3/mo) or Bitwarden (Free) generate unique, strong passwords for every account. You only need to remember one master password.

3. Never Text or Email Credit Card Info

Unencrypted texts are saved forever and easily intercepted. Always use a secure payment link from Square, Stripe, or Moil. If a customer tries to text their number, reply: "For your security, I'll send a secure payment link instead."

The 3-2-1 Backup Rule

If ransomware hits, you only survive if you have a clean backup. Follow the rule: Keep 3 copies of data, on 2 different types of storage, with 1 copy off-site (cloud). Tools like Backblaze ($7/mo) handle this automatically.

The 2026 Compliance Requirements

GDPR and CCPA now apply to almost any business with customer data. You are legally required to notify customers of a breach within 72 hours and provide a way for them to request data deletion. Moil generates compliant privacy policies and automated data deletion tools to keep you legal.

Cyber Insurance: Is It Worth It?

For $500–$2,000/year, cyber insurance covers ransom payments, data recovery, legal fees, and reputation management. We recommend it for any contractor over $250k/year in revenue.

Employee Training: The Human Firewall

Month 1: Teach password basics and 2FA setup.
Month 2: Spotting phishing—"Urgent" language and spelling errors.
Month 3: Data protection—no sensitive info in van paperwork.
Ongoing: 5-minute security check-ins during monthly meetings.

The Bottom Line

Average cost of a breach is $45,000. Prevention cost is $30/month. One prevented breach pays for 125 years of protection. In 8 weeks, by following our checklist, you can be more secure than 90% of your competitors.

Frequently asked questions

Why would hackers target a small plumbing or HVAC company?: Because you are easier and you still pay. Attacks are automated and indiscriminate — they scan for weak credentials, not for famous names. A contractor holds customer addresses, card details and payroll data, and usually has no IT staff, which is precisely the combination attackers look for.
What is the fastest thing I can do to protect my business today?: Turn on multi-factor authentication for email and banking, and stop reusing passwords. Those two changes block the overwhelming majority of real-world attacks and take about ten minutes. Everything else is worth doing, but nothing else has that ratio of effort to protection.
What is the 3-2-1 backup rule?: Three copies of your data, on two different types of storage, with one copy kept off-site. It is the reason ransomware becomes an inconvenience instead of a business-ending event: if you can restore from a clean copy, there is nothing to negotiate over.
Is cyber insurance worth it for a small contractor?: Usually yes, but read what it requires. Most policies now expect basic controls — MFA, backups, staff training — to be in place, and a claim can be denied if they are not. Treat the policy as a backstop for the basics, not a substitute for them.

Audit Your Security

Moil generates compliant privacy policies and helps you audit your digital operations. Secure your livelihood today.

Try Moil Free