Ransomware Moved Down-Market: A 2027 Cybersecurity Playbook for Mid-Sized Businesses

For a decade the story of ransomware was about giants — hospitals, pipelines, multinationals making headlines by paying millions. That story has quietly changed, and the 2026 numbers tell it plainly. Attackers have moved down-market, and the business most likely to be hit this year is not a household name. It is a company of fifty to two hundred people with real revenue, real data, and a security posture built for the smaller, safer company it used to be. If that sounds like yours, this is for you: what actually changed, how a modern attack really unfolds, the short list of controls that stops most of them, and the reporting clocks in Canada and the US that now start the moment you are breached.

We build and maintain software for companies in exactly this band, which means we see their security reality up close — not the policy document, the actual configuration. The gap between the two is where most breaches live. The good news, and it is genuinely good news, is that the measures preventing the overwhelming majority of attacks are neither exotic nor expensive. They are boring, well understood, and most businesses have simply never finished turning them on.

Why the attackers came for you

The shift is not random; it is economics. Large enterprises spent the last decade hardening — hiring security teams, buying tooling, raising the cost of attacking them. Small and mid-sized companies did not, and they turned out to be the better business for a criminal: valuable enough to extort, numerous enough to attack at scale, and under-defended enough to breach quickly. The data backs this up. Through the first half of 2026, tracked ransomware attacks rose roughly a fifth year over year, the United States remained the most-targeted country by a wide margin, and Canada sat near the top of the list behind it. Within those numbers, firms under two hundred employees absorbed the brunt.

Canada's own figures are sobering in a quieter way. The Canadian Centre for Cyber Security has tracked ransomware incidents rising by roughly a quarter every year since 2021. Statistics Canada found that about one in seven small firms reported a cybersecurity incident in a single year — and that barely one small company in twenty runs the kind of recurring, mandatory security training large firms treat as routine. The exposure is not a mystery. It is a training-and-configuration gap at scale.

What a modern attack actually looks like

The mental image most people carry — a sudden screen demanding Bitcoin — is a decade out of date. Today's intrusion is patient, and understanding its shape tells you where to put your defences:

• It starts with identity, not malware. Most breaches now begin with a valid login — a password reused from an earlier leak, an employee phished into typing their credentials, or a stolen session token. No alarm sounds, because nothing looks broken; someone simply logged in.
• It steals before it encrypts — if it encrypts at all. Because fewer victims are paying to unlock files, attackers have pivoted to theft and extortion: quietly copy the sensitive data, then threaten to leak it. Backups do not save you from a threat to publish your customers' records, which is exactly why the tactic spread.
• It moves sideways. Once inside, the intruder hunts for weak internal boundaries — shared admin passwords, flat networks, over-privileged accounts — and expands quietly, often for days or weeks, before anyone notices.
• It arrives through your vendors. A compromise of a supplier, a managed service provider, or a piece of software you installed is now one of the most common entry points, because it walks straight past your front door.
• It is increasingly written by AI. Phishing messages are no longer riddled with tells. They are fluent, personalised, and sometimes voiced — which means "spot the typo" is no longer a defence you can rely on your staff to provide.

The controls that stop most of it

Here is the part worth printing out. A small number of well-implemented controls prevent the large majority of real-world attacks. None of them is cutting-edge. All of them reward being finished rather than half-done:

• Phishing-resistant multi-factor authentication, everywhere. If one item on this list is non-negotiable, it is this. Move beyond SMS codes to app-based prompts or, better, passkeys and hardware keys, and require it on email, VPN, admin panels and every externally reachable system. The single most common breach — a stolen password — simply stops working.
• Backups that follow the 3-2-1 rule and are actually tested. Three copies of your data, on two kinds of media, with one off-site and offline or immutable so ransomware cannot reach it. Then restore from them on a schedule, because a backup you have never tested is a hope, not a control.
• Relentless patching of the known holes. The vast majority of intrusions exploit vulnerabilities that already had a fix available. A boring, reliable process for updating software and firmware beats any amount of advanced tooling layered over an unpatched system.
• Least privilege, enforced. Most people do not need administrator rights, and most accounts do not need access to most things. Separate admin accounts, remove standing privileges, and the blast radius of any single compromised login shrinks dramatically.
• Modern endpoint detection and response. Traditional antivirus looks for known-bad files; today's attacks use legitimate tools in illegitimate ways. Behaviour-based detection catches the lateral movement and gives you the trace you will need afterwards.
• Email and identity hardening. Enforce SPF, DKIM and DMARC so your domain is harder to spoof, and monitor for impossible logins and risky sign-ins. A large share of attacks never touch your network at all — they target the inbox and the identity provider.
• Network segmentation. A flat network where everything can reach everything is a single breach away from total compromise. Separating systems by function and sensitivity turns a catastrophe into a contained incident.

There is no product you can buy that makes you secure. Security is a set of unglamorous habits — patch, back up, limit access, verify identity — done consistently. The companies that get breached are rarely the ones that could not afford the tools. They are the ones that never finished turning them on.

The human layer is still the front line

Technology handles the mechanics, but people remain both the most-targeted surface and the most effective sensor. The businesses that weather attacks well treat their staff as part of the defence rather than the weak link to be blamed. That means short, frequent, realistic training instead of an annual slideshow; a culture where reporting a suspicious message or a mistaken click is rewarded, not punished, so you hear about problems in minutes rather than discover them in weeks; and clear, simple rules for the high-risk moments — a change of bank details, an urgent wire request, a login prompt that arrived out of nowhere. The Canadian data showing how few small firms run recurring training is not a footnote. It is one of the largest and cheapest gaps available to close.

Assume you will be breached — and rehearse it

Mature security is not the belief that nothing will get through; it is the preparation for when something does. The difference between an incident and a disaster is decided almost entirely before it happens, by whether you have a plan and have practised it:

• Know who does what. Who declares an incident, who briefs leadership, who contacts counsel, insurer and authorities, and who actually performs the technical containment. Decide this on a calm afternoon, not at 2am.
• Write the plan down and keep it offline. An incident response plan stored only on the network you have just lost access to is no plan at all. Keep a printed or out-of-band copy.
• Rehearse with a tabletop exercise. Walk the whole team through a realistic scenario once or twice a year. The first time you run your plan should not be during a real breach.
• Line up help in advance. Know which incident-response firm you would call, and have the relationship in place before you need it. The worst time to shop for responders is while the clock is running.
• Keep the evidence. Logging and sensible retention are what let responders reconstruct what happened — and what regulators and insurers will later ask you to produce.

The reporting clock is tightening on both sides of the border

A breach is no longer only an operational problem; it is a legal one with deadlines, and those deadlines keep getting shorter and more numerous. You do not need to be a lawyer, but you do need to know the clocks exist before one starts.

In Canada, PIPEDA has required organisations since 2018 to report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner, to notify affected individuals, and to keep records of every breach. Quebec's Law 25 layers its own notification duties on top for organisations handling the personal information of Quebec residents. And the federal government's long-running critical-infrastructure bill finally became law in June 2026 as the successor to Bill C-26 — the Critical Cyber Systems Protection Act — which, once its coming-into-force regulations are set, will require operators in federally regulated sectors like finance, telecommunications, energy and transport to run a cybersecurity program and report incidents to the Cyber Centre. As of late 2026 the Act is passed but not yet in force, which makes this the window to prepare rather than scramble.

In the United States, publicly traded companies have had to disclose material cybersecurity incidents within four business days under Securities and Exchange Commission rules since the end of 2023. Critical-infrastructure operators are awaiting the final CIRCIA rule, expected to require reporting substantial incidents to CISA within 72 hours and ransomware payments within 24 — a rule in final review as 2026 closes. Financial institutions answer to the FTC Safeguards Rule, and all fifty states have their own breach-notification laws with their own timelines. The practical takeaway is identical everywhere: the moment you are breached, several clocks may start at once, and the time to learn which ones apply to you is now, not during the incident.

Build security in — do not bolt it on

If your business runs on custom software, the cheapest security you will ever buy is the kind designed in from the first wireframe. Secure defaults, encrypted data, sound authentication, dependency scanning and a habit of threat-modelling new features cost very little when they are part of how the software is built, and a fortune when they are retrofitted after an incident. The same is true of the third-party code and services you depend on: knowing what is in your software supply chain, keeping it updated, and vetting the vendors who can reach your systems is now a core part of security, not an afterthought. We have written before about why building compliance and quality in from the start beats remediating later, and security is the sharpest example of that rule — because here the bill for leaving it late does not come from an auditor, it comes from an attacker.

Where to start this quarter

You do not have to do everything at once, and you should not try. Security maturity is built in a deliberate order, and the first moves are the ones with the highest return:

• Turn on phishing-resistant multi-factor authentication across every account that touches email, money or administration. This week, not this quarter.
• Verify your backups follow the 3-2-1 rule and perform one real restore. If you cannot restore, you do not have backups.
• Find and remove standing administrator rights nobody needs, and get a patching process you can actually sustain.
• Run one honest phishing-awareness session and establish a no-blame way for staff to report mistakes.
• Write a one-page incident response plan, store a copy offline, and book a single tabletop exercise.
• Map which breach-reporting obligations apply to you in Canada, the US, or both — before you ever need them.

None of that requires a security department you do not have. It requires deciding that this is the quarter you finish the basics. If you want an outside read on where your real gaps are — in your configuration, your software, or your plan — that is a conversation we are glad to have, and an honest assessment is worth far more than another tool you have not finished switching on.