Cybersecurity in Israel: why small businesses are easy targets

Tuesday, ten in the morning. The bookkeeper at a small garage in Petah Tikva receives an email from the regular parts supplier. Same logo, same signature, same writing style. "Please note that we have updated our bank details; here is the latest invoice." She transfers the payment as she does every month. Only this time, the money does not reach the supplier. The supplier never sent the email.

This story is not a Hollywood film, with a hooded hacker and flashing green screens. It happens every week in small offices across central Israel. Here begins the Israeli paradox: the local industry sells cybersecurity to half the world while a garage, real estate office and small clinic operate with one password sent to every employee on WhatsApp.

Why you?

This gap is not an accident. It is a market. To an attacker, a small business is an especially convenient target: no security department, nobody checking logs and usually money flowing regularly to suppliers and customers. Attacking a small business is cheap and easy; a modest ransom or one misdirected bank transfer more than covers the effort.

There is another, less pleasant reason: small‑business owners are convinced that "nobody is interested in us." That very thought lowers their guard.

How they really get in

Most of us imagine a dramatic break‑in, someone defeating sophisticated technological defenses. Reality is far duller, which is what makes it dangerous. The usual route is an email or message resembling a supplier, the Tax Authority, a delivery company or a regular customer. One link. A login page looking exactly like the original. One password entered. From that moment, someone else reads the mailbox.

What do they do there? Usually, they simply wait. They read correspondence, learn who pays whom, when and in what style. At the right moment, a payment request is sent from that mailbox to a customer, with a different bank account. The employee was not "hacked" in the cinematic sense. They simply authorized access without knowing it.

One door that closes most of the others

If there is one action worth taking today, it is two‑factor authentication. On email, on the bank account and on every system managing money or customers. Even if someone obtains the password, they face a code arriving on your phone.

How long does it take? Minutes, not a project. Yet many businesses leave it disabled because there is "no time" or it is "awkward for employees." Ten seconds of inconvenience at each login is a tiny price beside asking a customer to recover money transferred to strangers' account.

The backup you think you have

Ask most business owners whether they have a backup and they confidently answer yes. Ask where it is, and that confidence starts to wobble. Many do not know that ransomware locks every file the computer can see. A backup permanently connected to the same computer, on the same drive or in the same synchronized folder, is locked along with them.

A real backup lets you return to yesterday. A copy updated to a cloud service with version history, or an external drive disconnected after backup. Every few months, try restoring one file to make sure it actually works. Without such a backup, the business does not restore. It bargains with whoever locked the folders.

Afterward: what not to do

If it has already happened, the first thing is to breathe. The biggest mistakes happen in the first hour, out of panic. Do not pay a ransom before speaking with the bank and a professional familiar with the attack type. Do not wipe the computer and reinstall everything before preserving what you can, because that is where the evidence is.

Do change passwords, but from another, clean computer rather than the affected one. Contact the bank immediately if money went out, because a transfer can sometimes be stopped. The Israel National Cyber Directorate's 119 hotline also serves small businesses. Tell customers if a payment request was sent from your mailbox. It is embarrassing, but silence makes them the second victim.

A short list for the coming week

You do not need a bank's budget. You need four things now. Two‑factor authentication wherever possible. Separate passwords for the business and guest networks, so a customer joining the Wi‑Fi is not on the same network as the accounting computer. A tested backup with history. And updates for the software the business actually uses.

An expensive firewall without these four things is a sign on the door, not a lock. As for the next email from the "regular supplier," before sending money to a new account, make a call. Use the number you already have, not the one in the email.