When a cyberattack hits a small Irish business, the ransom note (if there's even a note) is rarely the biggest cost. Time is. Systems are down, staff are idle and customers are waiting while someone works out what happened and whether the backups are any good. New research puts a number on that time, and it's not a small one.
The numbers behind the headline
Hiscox surveyed 300 cybersecurity decision-makers at Irish businesses with fewer than 250 employees, part of a wider study of 6,800 businesses across ten countries. Beyond the 34 hours of downtime, it's the knock-on effects that hurt a small operation: 36% of affected businesses said they lost business opportunities or partnerships as a direct result, and 34% said they delayed growth or new initiatives while dealing with the fallout. Reputational damage was the single biggest worry, named by 48% of respondents, ahead of any technical concern. As the Irish Examiner reported, 67% of Irish SMEs now carry cyber insurance, a sharp rise from previous years. That tells you how seriously owners are taking it now.
Where those 34 hours actually go
It's rarely one long outage. It's isolating the affected machines, working out what's clean and what isn't, restoring data, checking nothing reinfects on the way back up, and then telling staff, customers, suppliers and (if it's serious enough) an insurer, all before normal work can resume. Every one of those steps takes far longer when the backup wasn't ready. We've written before about the most common security mistake we see in Irish small businesses, which is having no proper offsite backup. This is where that gap turns a bad day into a lost week.
What actually shortens the clock
The National Cyber Security Centre's own guidance for small businesses is refreshingly unglamorous about this. It's mostly habits:
Backup habits that stretch recovery
- One copy, on a drive plugged straight into the same machine
- Nobody has ever actually tried restoring from it
- It grabs the desktop and documents, but not the accounts or CRM database
- The last successful backup was months ago and nobody noticed
What the NCSC recommends
- A copy kept somewhere not directly connected to the network
- Backups tested by actually restoring something from them
- Frequency matched to how often the data changes
- A cloud or dedicated backup service, so recovery isn't riding on one disk
Building it properly: the 3-2-1 rule
The original, plus two backups
So one failure (a dead drive, a bad update, an attack) never leaves you with nothing.
Not two copies of the same drive
A local backup and a separate cloud copy, so a single fault can't take out both at once.
Physically or logically separate
Kept off the everyday network, exactly as the NCSC advises, so ransomware that spreads across your systems can't reach the backup too.
Test the restore
Pick a file and actually bring it back. Quarterly is plenty, but it has to happen at least that often.
Worth a quick sanity check this week, whatever your current setup:
- Find out exactly where your backups are kept, in writing, not from memory
- Confirm at least one copy isn't reachable from your everyday network
- Restore one real file from it, just to prove the process works
- Check it actually covers your accounts or CRM data, not just documents
Where I'd start
The Hiscox numbers describe a typical Irish small business, not necessarily yours. The pattern holds, though. The downtime and the fallout do the damage, far more than any ransom demand. A properly built backup that you've actually tested is the cheapest insurance most businesses will ever buy. If you're not sure yours would get you back up and running, spend an hour finding out now, before you need it.
