Phishing and Ransomware 2026: An SME Survival Checklist

Think your company is too small to be attacked?

The opposite is true: attackers love small businesses because there is less protection. Phishing emails and ransomware are the two biggest threats facing Hong Kong SMEs.

Five things you can do today

1. Learn the signs of phishing. Urgency, limited time, click now, account suspended — these are red flags. And check the actual email address, not just the display name.

2. Turn on two-factor authentication (2FA). Even if your password is stolen, attackers cannot get in without your phone. Best value for money in security.

3. Back up with the 3-2-1 rule. Three copies, two different storage types, one stored offline. With backups, ransomware becomes an inconvenience, not a ransom demand.

4. Keep software updated. Many attacks exploit known vulnerabilities with patches that were released months ago — nobody installed them.

5. Train your staff. The weakest link is almost always human. Remind people not to click links blindly; it is the cheapest insurance there is.

What if you are hit?

Disconnect from the network, do not pay the ransom (it does not guarantee recovery), preserve evidence, notify the right people, and call in professionals to clean up.

If your company has never had a security review, ask FROMDB for a quick check — at least find out where the biggest risks are.