# Cybersecurity for Plumbers: Protecting Your Business from Ransomware *Legal & Compliance · 9 min read · Published 2025-12-18 · Moil Insights* > Hackers aren't targeting Google; they are targeting you. Why small trades are the new #1 target and how to lock your digital doors. Canonical URL: https://blog.moilapp.com/article/cybersecurity-for-plumbers-protecting-your-business-from-ransomware --- ## Why Hackers Target Small Contractors The assumption that "I'm too small to hack" is dangerous. Small businesses are now the #1 target because they have money, valuable customer data (including home entry codes and credit cards), and typically weak security. 43% of all cyber attacks now target SMBs, and 60% of those businesses close within 6 months of a major breach. ## The 5 Real Threats Facing Contractors - 1. Ransomware: Hackers lock your job schedules and financial records, demanding $5k–$30k for the key. Loss: Total business shutdown. - 2. Phishing: Emails pretending to be Home Depot or your bank to steal login info. One click on a fake invoice can compromise your accounts. - 3. BEC (Business Email Compromise): A hacker watches your emails for weeks, then tells your bookkeeper to change the bank deposit for a large job. Average loss: $100,000. - 4. Data Breaches: Customer names and addresses are exposed. 2026 laws impose fines up to $7,500 PER RECORD in some states. - 5. Smart Device Hacks: Compromised shop security cameras or smart van locks allow physical theft. ## The 10-Minute Security Basics (Do These NOW) ### 1. Enable Two-Factor Authentication (2FA) Require a code from your phone to log in to email, banking, and QuickBooks. This blocks 99% of unauthorized access. Use apps like Google Authenticator or Authy instead of SMS. ### 2. Use a Password Manager Stop using "Plumbing123". Tools like 1Password ($3/mo) or Bitwarden (Free) generate unique, strong passwords for every account. You only need to remember one master password. ### 3. Never Text or Email Credit Card Info Unencrypted texts are saved forever and easily intercepted. Always use a secure payment link from Square, Stripe, or Moil. If a customer tries to text their number, reply: "For your security, I'll send a secure payment link instead." ## The 3-2-1 Backup Rule If ransomware hits, you only survive if you have a clean backup. Follow the rule: Keep 3 copies of data, on 2 different types of storage, with 1 copy off-site (cloud). Tools like Backblaze ($7/mo) handle this automatically. ## The 2026 Compliance Requirements GDPR and CCPA now apply to almost any business with customer data. You are legally required to notify customers of a breach within 72 hours and provide a way for them to request data deletion. Moil generates compliant privacy policies and automated data deletion tools to keep you legal. ## Cyber Insurance: Is It Worth It? For $500–$2,000/year, cyber insurance covers ransom payments, data recovery, legal fees, and reputation management. We recommend it for any contractor over $250k/year in revenue. ## Employee Training: The Human Firewall - Month 1: Teach password basics and 2FA setup. - Month 2: Spotting phishing—"Urgent" language and spelling errors. - Month 3: Data protection—no sensitive info in van paperwork. - Ongoing: 5-minute security check-ins during monthly meetings. ## The Bottom Line Average cost of a breach is $45,000. Prevention cost is $30/month. One prevented breach pays for 125 years of protection. In 8 weeks, by following our checklist, you can be more secure than 90% of your competitors. ## Frequently asked questions ### Why would hackers target a small plumbing or HVAC company? Because you are easier and you still pay. Attacks are automated and indiscriminate — they scan for weak credentials, not for famous names. A contractor holds customer addresses, card details and payroll data, and usually has no IT staff, which is precisely the combination attackers look for. ### What is the fastest thing I can do to protect my business today? Turn on multi-factor authentication for email and banking, and stop reusing passwords. Those two changes block the overwhelming majority of real-world attacks and take about ten minutes. Everything else is worth doing, but nothing else has that ratio of effort to protection. ### What is the 3-2-1 backup rule? Three copies of your data, on two different types of storage, with one copy kept off-site. It is the reason ransomware becomes an inconvenience instead of a business-ending event: if you can restore from a clean copy, there is nothing to negotiate over. ### Is cyber insurance worth it for a small contractor? Usually yes, but read what it requires. Most policies now expect basic controls — MFA, backups, staff training — to be in place, and a claim can be denied if they are not. Treat the policy as a backstop for the basics, not a substitute for them. **Audit Your Security** — Moil generates compliant privacy policies and helps you audit your digital operations. Secure your livelihood today. [Try Moil Free](https://moilapp.com/business) --- ## Related guides - [Safety Compliance Made Simple: The Contractor's Survival Guide](https://blog.moilapp.com/article/safety-compliance-made-simple-the-contractor-s-survival-guide.md) - [The Burning Man: Preventing Contractor Burnout Before It Destroys You](https://blog.moilapp.com/article/the-burning-man-preventing-contractor-burnout-before-it-destroys-you.md) - [Building a Team Culture That Doesn't Suck: Real Talk for Small Trades Businesses](https://blog.moilapp.com/article/building-a-team-culture-that-doesn-t-suck-real-talk-for-small-trades-businesses.md) - [Top AI Trends Every Small Business Owner Should Know for 2026](https://blog.moilapp.com/article/top-ai-trends-every-small-business-owner-should-know-for-2026.md)