Technology Advisor Blog

What a Cyberattack Really Looks Like for a Small Law Firm in Greater Boston

lhanson@ekaru.com (Linda Hanson) — Thu, 15 Oct 2026 13:42:41 GMT

Most people picture a cyberattack as something dramatic and obvious. For a small law firm in Greater Boston, the reality is that it usually starts with an email that feels routine and ends with an unexpected phone call.

This is a composite story built from situations we see and hear about regularly. The firm is fictional, but the details are not.

It Started With One Email

A paralegal at a five-person law firm clicked a link in what looked like a document-sharing notification from a vendor the firm actually uses. She entered her credentials on what looked like a legitimate login page and went back to work. The whole thing took thirty seconds and felt like nothing.

Eleven days later, a partner noticed a client hadn't responded about a wire transfer for a real estate closing. He sent a follow-up. The client called back confused because they had already sent the wire on Friday. The partner pulled up the email thread and found a message he did not remember sending, from his own address, with updated wire instructions pointing to an account nobody at the firm had ever heard of.

During those eleven days, the attacker had read thousands of emails, identified the firm’s banking relationships, learned how the partners write, and set up a forwarding rule so that every incoming email was quietly being copied to an address nobody at the firm could see.

What Happened Next

The firm called their IT provider. Passwords were changed, and they were told the situation appeared contained. Nobody checked whether the forwarding rule was still active. Nobody looked at what eleven days of access had actually exposed.

Three days later, a second client called about a suspicious invoice. Then a third.

By the time the firm had a full picture of what happened, the damage was already done. The forensic investigation cost several thousand dollars. The cyber insurance carrier asked for documentation of security controls the firm could not provide. The claim became complicated in ways nobody had anticipated, and the conversations with affected clients were harder than any of the technical recovery work.

What Would Have Stopped It

The entry point was a thirty-second mistake that anyone could have made on a busy afternoon. Multi-factor authentication on that email account would have stopped the attacker cold even after the credentials were stolen, because they would not have had the second factor needed to get in. A simple process of calling to verify any changes to wire instructions would have caught the fraudulent request before the client sent anything.

Neither of those things is expensive or technically complicated. They just require knowing what to put in place and someone making sure it actually happens.

Why This Matters for Your Firm

Law firms hold sensitive client information, manage significant financial transactions, and operate on relationships built entirely on trust and confidentiality. A breach is not just a financial problem. It is a professional and reputational one that can follow a firm for years.

Under the Massachusetts Data Security Law, the obligation to protect client information is not optional, and the consequences of getting it wrong extend well beyond the immediate financial loss. Most small law firms we speak with in Greater Boston are aware of this in a general sense but have never had someone sit down and make sure the basics are actually in place.

If you read this and thought about your own firm, that reaction is worth paying attention to. The firms that avoid situations like this are not the ones that got lucky. They are the ones that asked the hard questions before something forced it.

At Ekaru, we work with professional services firms across Westford, Acton, Chelmsford, Lowell, and greater Boston. If you want to know where your firm actually stands, a free IT assessment is the fastest way to find out.

Cybersecurity Awareness Month: Small Steps Can Make a Big Difference

Ann Westerheim — Mon, 05 Oct 2026 20:51:42 GMT

October is Cybersecurity Awareness Month, and once again, Ekaru is proud to be a Cybersecurity Awareness Month Champion.

We’ve participated in the Champion program for many years because its mission closely aligns with our own: helping people and businesses understand cybersecurity and take practical steps to protect themselves.

Cybersecurity Awareness Month was started in 2004 as a collaboration between the National Cybersecurity Alliance and CISA - Cybersecurity & Infrastructure Security Agency.

For us, cybersecurity has never been about creating fear.

It’s about empowerment.

“Our mission from the beginning has been to work with local businesses to help them be more productive with technology - and to keep that technology safe. We’re delighted to once again be a Cybersecurity Awareness Month Champion and help explain cybersecurity principles in plain English. Big corporations may make the headlines, but cybersecurity is really a local issue. It affects you, your family, your employees, and the businesses in your community every day.”

— Ann Westerheim, Ekaru

Don’t Make It Easy for Them

This year, the National Cybersecurity Alliance (NCA) has a refreshingly straightforward theme for Cybersecurity Awareness Month: “Don’t Make It Easy for Them.”

Cybercriminals are constantly looking for opportunities, but that doesn’t mean protecting your business has to involve an enormous cybersecurity budget or complicated technology.

In fact, one of the most important messages from this year’s campaign is that small actions can make a big difference.

That’s a message we strongly believe in at Ekaru.

We work with local small and midsized businesses every day. We understand that business owners are balancing a lot of priorities: serving customers, supporting employees, managing costs, and growing their businesses. Cybersecurity can sometimes feel like one more complicated thing on an already long list.

It doesn’t have to be.

There are smart, affordable steps every organization can take to become significantly more secure.

A View From Our Own Community: 78,000 Failed Attacks in One Month

In just the past month, the Microsoft 365 security monitoring we manage for our local business clients recorded more than 78,000 FAILED attacks.

That number may sound alarming, but here's the important word: failed.

These attacks were unsuccessful. The number doesn't mean 78,000 accounts were compromised. Instead, it gives us a window into just how persistent cyber threats have become. Attempts to get into Microsoft 365 accounts aren't rare events reserved for large corporations. They're happening all the time - including to small businesses right here in our community.

Automated attackers don't care whether you're a Fortune 500 company or a 20-person local business. They're looking for an opportunity and an easy way in.

That's why we don't share this number to create fear. We share it because it demonstrates the value of good cybersecurity.

The goal isn't to stop attackers from trying. It's to make sure they keep failing.

That's what “Don't Make It Easy for Them” looks like in the real world.

Four Simple Ways to Make Your Business Harder to Attack

The National Cybersecurity Alliance recommends starting with four fundamental cybersecurity habits:

1. Use strong passwords and a password manager.
Reusing passwords makes a cybercriminal’s job much easier. A password manager helps employees use strong, unique passwords without having to remember every one of them.

2. Turn on multifactor authentication.
Multifactor authentication (MFA) adds another layer of protection beyond a password. For businesses using Microsoft 365 and other cloud applications, properly configuring MFA is one of the most important steps you can take to protect accounts. Yes, MFA adds another step and can be inconvenient, but its so important.

3. Recognize and report scams.
Technology is important, but people are an important part of cybersecurity too. Teach employees to slow down when they receive an unexpected request, suspicious link, unusual invoice, or message asking them to act urgently. Just as importantly, create a culture where employees feel comfortable reporting something suspicious.

4. Keep software updated.
Updates aren't just about getting new features. They frequently fix security vulnerabilities. Keeping computers, applications, browsers, phones, and other devices current helps close doors attackers might otherwise use.

None of these steps requires your business to become a cybersecurity expert.

They simply make your organization a harder target.

AI Has Changed the Speed But Not the Fundamentals

There's another reason these basic protections matter so much right now: Artificial Intelligence is making it possible for attackers to move faster and operate at greater scale.

But faster attacks don't necessarily require an entirely new cybersecurity playbook.

As SecurityWeek recently put it: “AI Has Changed Attack Speed, Not Security Fundamentals.”

That's an important distinction for small businesses.

AI can help criminals create convincing phishing messages faster, automate parts of an attack, and increase the volume of attempts. But the fundamentals of protecting your business remain remarkably familiar.

Strong identity protection. MFA. Updated systems. Secure configurations. Backups. Employee awareness. Monitoring. And a plan for responding when something goes wrong.

Despite the wild headlines, AI hasn’t changed the basics of cybersecurity - it has just made attackers faster and more efficient at finding the same old weaknesses.

Cybersecurity Should Empower Your Team, Not Frighten Them

There's plenty of scary cybersecurity news out there: ransomware, data breaches, phishing, business email compromise, identity theft, and increasingly sophisticated AI-enabled scams.

Those risks are real. But fear by itself doesn't make a business more secure.

Education does | Good technology does | Good habits do.

And having someone you trust to help you make sensible decisions does.

That's why our approach at Ekaru is focused on making cybersecurity understandable and manageable. We want business owners to understand what matters, what they can do about it, and where their technology investment will make the biggest difference.

Cybersecurity shouldn't be something only an IT person can understand. It should make sense in plain English.

Small Businesses Have More Options Than They May Realize

The National Cybersecurity Alliance's 2026 Small Business Cybersecurity Awareness & Practices Survey reinforces an important message: there are practical, low-cost cybersecurity improvements businesses can make right now.

We see that every day. Simple actions can GREATLY reduce your risk. Risk isn't eliminated, but greatly reduced with very simple actions.

Sometimes better security means adding a new security tool. But sometimes it means properly configuring technology you're already paying for. It can mean enabling MFA, improving Microsoft 365 security settings, keeping systems patched, training employees, establishing reliable backups, or putting a process in place for what happens when someone receives a suspicious email.

Cybersecurity doesn't have to start with spending a fortune.

It starts with understanding your risks and taking the right next steps.

Cybersecurity Is Local

When a major corporation suffers a cyberattack, it makes national headlines.

But most cybersecurity doesn't happen in the headlines.

It happens when someone at a local business receives a convincing phishing email. When an employee's password is exposed. When someone gets a fake Microsoft 365 login prompt. When an invoice request doesn't look quite right. Or when a family member receives a text message designed to trick them into clicking a link.

That's why cybersecurity awareness matters to all of us.

Ekaru has been a Cybersecurity Awareness Month Champion for many years because cybersecurity education is part of our commitment to the businesses and communities we serve.

We believe local businesses deserve access to thoughtful cybersecurity guidance and strong security technology - but in a way that makes sense for their size, their budget, and the way they actually work.

And you don't have to fix everything overnight.

Start with ONE thing.

Turn on MFA. Review your backups. Update an old computer. Talk to your employees about phishing. Check the security settings in Microsoft 365. Make sure you know who to call if something suspicious happens.

Then take the next step.

That's how stronger cybersecurity is built: one smart decision at a time.

This Cybersecurity Awareness Month, Don't Make It Easy for Them.

And if you're not sure where to start, Ekaru is here to help you understand the risks, prioritize what matters, and take smart, practical steps to protect your business.

About the author:

Ann Westerheim, PhD is the Founder and President of Ekaru, a Technology Service Provider of cybersecurity and IT services for small and medium businesses in the greater Boston area. Ann is an accomplished technology innovator and leader with three engineering degrees from MIT. She has twenty years of high tech experience in research, advanced development, product development, and as an entrepreneur. Her career has spanned a vast range of technology endeavors including research in thin film semiconductors and superconductors, microprocessor fabrication, development of early Internet medical applications, and now focusing on the application of technology in business. She has an avid focus on the "last mile" of technology and decreasing the digital divide.

Your Business Is More Exposed Than You Think: A Cybersecurity Checklist

lhanson@ekaru.com (Linda Hanson) — Mon, 28 Sep 2026 15:29:04 GMT

If someone asked you right now how secure your business is, what would you say?

Most small business owners in greater Boston would give some version of "probably fine." Not confident, or certain. Just probably fine. And that gap, between probably fine and actually protected, is where most incidents quietly begin.

October is Cybersecurity Awareness Month, and rather than adding to the pile of generic awareness content that shows up every year, we wanted to give you something you could actually use. Work through this checklist with your team and be honest with yourself. If you get to the end and find gaps you did not know existed, that is genuinely valuable information, and it is better to find out now than when something forces it.

1. Passwords and Password Manager

Does every account your business uses have a strong, unique password that is not shared anywhere else? If the honest answer is no or you are not completely sure, a password manager is the single fastest and most practical improvement most small businesses can make. It removes the memory burden while making sure every account has its own key.

Think about it this way: if one employee account was compromised today, how many others would fall because the same password was used elsewhere?

2. Multi-Factor Authentication

Is MFA enabled on every account that supports it, including email, cloud storage, financial accounts, and anything your team accesses remotely? A strong password is no longer enough on its own. MFA stops most account takeover attempts, even after a password has been exposed.

If an attacker had your email password right now, what is actually standing between them and full access?

3. Software and Device Updates

Are all the computers, phones, and devices your team uses running the latest available updates? Unpatched systems are one of the most consistent entry points attackers exploit because the vulnerabilities they target have often already been fixed. The patch exists. The device just never received it.

It is also worth checking whether any of your equipment has reached end of life entirely. Windows 10 reached end of support in October 2025, meaning it no longer receives security updates at all. Windows Server 2012 has been unsupported since 2023. Devices still running either of these are not just unpatched, they are permanently exposed with no fix coming.

When did someone last check that every device in your office is actually up to date?

4. Phishing Awareness

Does your team know what a phishing email looks like in 2026? Not the obvious ones with broken grammar and suspicious links, but the professionally written personalised messages that impersonate vendors, colleagues, and financial institutions convincingly enough to fool someone moving quickly through a full inbox.

If a convincing phishing email landed in someone's inbox today, would they catch it and would they know who to tell?

5. Backup Testing

Does your business have a backup in place, and when did someone last verify it actually works? An untested backup is not a safety net. It is an assumption. Businesses that discover their backup was silently failing almost always find out during a ransomware recovery, when it is far too late to do anything about it.

If your most important files disappeared tomorrow, how confident are you that they could be fully restored?

6. Former Employee Access

Are there accounts belonging to former employees that still have access to your systems, email, or cloud storage? This is one of the most common and most overlooked gaps we find when working with small businesses in Greater Boston for the first time. Offboarding is rarely handled as consistently as it should be, and the accounts that get forgotten are the ones that become entry points.

When did someone last audit who actually has access to your business systems?

7. Cyber Insurance Review

Does your business carry cyber insurance and does your current policy actually reflect the security controls you have in place today? Insurers are asking increasingly specific questions at renewal about MFA, endpoint protection, and backup practices. A policy that was accurate when it was written may not be accurate now and a claim filed against an inaccurate application can be denied at the worst possible moment.

When did you last read your policy carefully?

8. Incident Response Plan

If something went seriously wrong tomorrow morning, does your team know what to do, who to call, and in what order? An incident response plan does not need to be a lengthy document. It needs to be clear enough that the right people can follow it under pressure without having to figure it out in real time.

If ransomware hit your business at 8am on a Monday, what actually happens in the first hour?

How Did Your Business Score?

If you worked through that and felt genuinely confident about every item, your business is in better shape than most, and that is worth acknowledging.

If you found gaps or realized you did not know the answer to several of those questions, that clarity is valuable. Most small businesses never take the time to find out where they actually stand until something forces it. You just did.

Throughout October, Ekaru will be sharing practical tips on LinkedIn covering each of these areas as part of Cybersecurity Awareness Month. Follow along and share this checklist with someone on your team who would benefit from working through it.

And if you want someone to work through it with you, that is what we are here for.

At Ekaru we offer a free IT assessment for small businesses across Westford, Acton, Chelmsford, Lowell, and greater Boston. No obligation, just honest answers from a local team that genuinely cares about keeping your business protected.

Did You Receive a Verizon Letter About Your Copper Phone Line?

Ann Westerheim — Fri, 18 Sep 2026 14:06:11 GMT

We've recently heard from several clients who received letters from Verizon about the retirement of traditional copper phone lines - particularly at their homes.

Linda also recently received one of these letters from Verizon, and it got us talking. She still keeps an old-fashioned corded phone in her basement - not because she's nostalgic for the days of tangled phone cords, but because it has served a very practical purpose: When one of those big New England storms comes through and the power goes out, that old phone still works. No electricity. No Wi-Fi. No modem or router. Just plug the phone into the copper phone jack and get a dial tone!

If you received a letter too, you may be wondering: What does this mean? Is my phone line going away? And do I need to do anything?

We started looking into the details and realized there's more to this transition than simply replacing an old-fashioned telephone line.

Copper phone lines have been around for generations, and they may still support things you don't immediately think about - including alarm systems, fax machines, medical devices, elevator phones, fire panels, and other equipment. There are also important differences between traditional copper service and newer technologies when it comes to power outages and backup power.

So whether you received a notice for your home or your business, it's worth understanding what's changing before making any decisions.

Why Is Verizon Retiring Copper Phone Lines?

Verizon is modernizing its network and transitioning away from its aging copper infrastructure toward newer fiber and wireless technologies. They have been working on this for many years.

According to Verizon, customers affected by the transition will receive advance notice, and an approved replacement service will be available before existing copper service is discontinued.

For many people, the transition may be relatively straightforward. If the line is simply being used for telephone calls, there are plenty of modern alternatives.

But before you replace or cancel a copper line, there's an important question to answer:

What is connected to it?

Your Copper Line May Be Doing More Than You Realize

When we say "phone line," most of us picture a telephone.

But traditional copper lines - often referred to as POTS lines, or "Plain Old Telephone Service" - have been used for all kinds of equipment over the years.

Your line could be supporting:

A home or business security system
A fire alarm panel
An elevator emergency phone
A fax machine
A medical alert or other medical device
An entry or intercom system
An emergency or backup telephone
Other older equipment designed to communicate over an analog phone line

Some of these systems may have been installed years ago and simply continued working in the background.

That's why we wouldn't recommend simply disconnecting a copper line until you know exactly what depends on it.

What About Your Alarm System?

This is one of the first questions we're hearing.

If your home or business alarm system communicates with its monitoring company over your copper telephone line, contact your alarm company before making a change.

Many modern alarm systems no longer need a traditional telephone line. Depending on the equipment, a cellular communicator or a combination of cellular and Internet connectivity may be a better long-term solution.

The key is not to assume that an ordinary VoIP phone line is automatically the right replacement for an alarm line.

And for specialized systems such as commercial fire alarms, additional codes and requirements may apply, so the appropriate alarm or fire-system provider should be involved before the existing line is disconnected.

One Big Difference: What Happens When the Power Goes Out?

There's one remarkable feature of the old copper telephone network that's easy to overlook because, for decades, we simply took it for granted:

Your copper phone line didn't depend on the electricity in your house. The telephone network provided the power.

Traditional landline phones received their power from the telephone company's central office, they didn't depend on your local electric service. Those facilities were equipped with large battery systems and backup generators designed to keep the telephone network operating during power failures and major emergencies. Copper phone lines have been used for around 150 years! Yes, its been a while!

The resilience of the old Bell System went far beyond the occasional power outage. During the Cold War, significant portions of the telecommunications network were engineered with hardened facilities, redundant routes, and extensive backup power as part of an effort to keep critical communications functioning even in catastrophic events - including the possibility of nuclear attack. Its the end of an era.

That's an extraordinary level of resilience when you think about what it meant in everyday life.

Here in New England, imagine an ice storm takes down power across your area and your home is without electricity for several days. With a traditional copper line and a simple corded telephone, you could still pick up the phone, hear a dial tone, and make a call - without a modem, router, Wi-Fi, or electricity in your home. The fiber, cable, and Internet-based phone lines typically include a local battery backup, but that won't last long enough for a New England storm!

That doesn't make the newer technology worse. But it does mean that something the old telephone network provided inherently - power and resilience during an outage - now needs to be considered as part of your own backup-power planning. Remember to keep your cell phone charged, and consider getting a generator.

It's something worth planning for.

Can I Keep My Existing Phone Number?

Short answer, Yes! According to Verizon, customers can port their existing telephone number to another Verizon service or to another service provider.

So the retirement of the copper infrastructure doesn't necessarily mean giving up a telephone number you've had for years.

What Should You Do If You Received a Letter?

First, don't panic - but don't ignore it.

Before changing or canceling anything:

Identify the telephone number referenced in the notice.
Determine what's connected to that line.
Check whether an alarm, medical device, fax, emergency phone, or other equipment depends on it.
If specialized equipment is involved, contact the company that services that equipment.
Consider what will happen during a power or Internet outage.
Then determine which replacement option makes sense for your situation.

The right answer won't necessarily be the same for everyone. Keep in mind also that the changes still need to be approved by the FCC so this will take a while.

Technology Changes. Make Sure You're Ready.

Copper phone lines have quietly served homes and businesses for decades. Most of us probably never thought much about the infrastructure behind them - because it simply worked. I've had the same home phone number for over 25 years, and made the switch from copper to fiber many years ago.

Now that the network is changing, it's worth taking a few minutes to understand what you have before it's replaced. Plan ahead for reslience!

We've already had clients reach out to us after receiving these Verizon notices, and we're happy to help answer questions about the technology and your options.

Want the Full Update Directly From Verizon?

For the latest information about Verizon's copper network retirement, replacement options, frequently asked questions, and what to expect if your service is affected, visit Verizon's official Network Modernization page:

Verizon Network Modernization - Copper Replacement Information
https://www.verizon.com/copper/

Here is some additional information from the FCC regarding the technology changes:

Tech Transitions - Modernizing Communications Services

https://www.fcc.gov/tech-transitions

If you've received a letter and aren't sure what it means for your home or business - or you're not sure what's actually connected to your existing copper line - reach out to Ekaru. We're happy to help you understand your options and plan your next steps.

About the author:

Are You Paying Too Much for Your IT Services?

lhanson@ekaru.com (Linda Hanson) — Mon, 14 Sep 2026 15:57:49 GMT

Most small business owners in greater Boston cannot confidently answer that question and that uncertainty is worth paying attention to.

Not because your current provider is necessarily doing anything wrong. Often it comes down to a lack of clarity about what is actually being covered, what is not, and whether the investment makes sense for where your business is today.

What You Should Be Getting for Your IT Investment

Managed IT support for a small business should cover more than fixing things when they break. If your current arrangement is primarily reactive, meaning someone shows up or calls back after something has already gone wrong, that is a meaningful gap in what you are paying for.

At a minimum, your IT investment should include continuous monitoring of your devices and network so problems are caught before they affect your day, regular security patching so your systems are not left exposed by vulnerabilities that have already been fixed, backup monitoring and testing so you know your data is recoverable before you need to recover it, and a responsive helpdesk that your team can actually reach when something needs attention.

If you are paying for IT support and not receiving those things consistently, you may not be getting what you are paying for regardless of what the invoice says.

The Hidden Cost of Reactive IT

Most small businesses significantly underestimate what IT problems actually cost them. The invoice from their IT provider is visible. The lost productivity, the employee downtime, the missed client deadlines, and the stress of managing a technology crisis are not itemized anywhere but they are very real.

A business with five employees losing two hours to an IT issue that should have been prevented costs considerably more than the cost of fixing it. Multiply that across a year and the true cost of reactive IT support often exceeds what proactive managed IT would have cost in the first place.

Questions Worth Asking Before Your Next Renewal

If your IT contract is coming up for renewal or you have simply never taken a close look at what you are getting, these questions are worth asking.

What is actually included in what I am paying for each month?
When did someone last review who has access to our systems?
When was our backup last tested?
Are all of our devices fully patched right now?
What would happen in the first hour if something went seriously wrong?

If the answers are unclear or unsatisfying, that is worth addressing before you sign another year.

What a Better Arrangement Looks Like

The right IT partner for a small business in greater Boston is not necessarily the cheapest option or the most expensive one. It is the one that gives you a clear picture of what is covered, monitors your environment proactively, responds quickly when something needs attention, and helps you make informed decisions about your technology without making you feel like you need a computer science degree to follow the conversation.

At Ekaru we offer a free IT assessment for small businesses across Westford, Acton, Chelmsford, Lowell, and greater Boston. It is not a sales pitch. It is an honest look at your current setup, what is working, what is not, and whether your current IT investment is delivering what your business actually needs.

If you have been wondering whether you are getting what you are paying for, that conversation starts at Ekaru.com or by calling us at 978-692-4200.

What Should You Do If You Think You Have Been Hacked?

lhanson@ekaru.com (Linda Hanson) — Fri, 28 Aug 2026 14:25:34 GMT

If something about your business technology feels wrong today, that instinct is worth taking seriously. Whether it is a computer behaving strangely, an employee flagging an unfamiliar login, or a client who received a suspicious email from your address, the worst possible response is to convince yourself it is probably nothing and wait.

How you respond in the first hour can significantly affect the outcome. Here is exactly what to do.

1. Do Not Touch Anything Yet

Before taking any action, call your IT provider. Deleting files, wiping devices, or attempting to fix things yourself before anyone has assessed the situation can destroy evidence that investigators need and make recovery considerably harder. If you do not have an IT provider you trust, that conversation starts at ekaru.com.

2. Disconnect Affected Devices From the Network

If you have identified a compromised device, unplug its ethernet cable or disable its Wi-Fi connection. Do not turn it off entirely as this can destroy forensic data, but isolating it from the network prevents the threat from spreading. If you are not sure which device is affected, your IT provider can help identify the scope before you start disconnecting things.

3. Change Your Passwords Immediately

From a clean unaffected device, change passwords on your most critical accounts starting with email, then financial accounts, then core business applications. Enable multi-factor authentication on everything that supports it. Avoid doing this from any device you suspect may be compromised.

4. Identify What Was Accessed

Once the immediate threat is contained, you need to understand what the attacker actually reached. Which systems, what data, and how long they had access are all questions that shape everything that follows including your legal obligations.

For small businesses in Massachusetts handling personal information, a breach may trigger notification requirements under 201 CMR 17.00, the Massachusetts Data Security Law. HIPAA, PCI, and other industry regulations may impose additional obligations with their own deadlines. Getting this wrong adds legal and financial exposure on top of the breach itself.

5. Notify the Right People

Your IT provider and a legal advisor should both be involved in deciding who to notify and when. Depending on the incident you may need to contact affected individuals, state regulators, law enforcement, and your cyber insurance carrier. Report cybercrime at ic3.gov and contact your insurer as early as possible since most policies require prompt notification and provide access to forensic and legal resources that reduce your costs significantly.

6. Preserve the Evidence

Do not delete anything that triggered your concern. Suspicious emails, login alerts, ransomware messages, and unusual account activity are all evidence. Screenshot anything unusual and let your IT provider preserve forensic data properly before anything is removed or overwritten.

7. Understand How It Happened

Once the crisis is behind you, understanding how the attacker got in is the most important question to answer. A phishing email, a compromised password, an unpatched vulnerability, or a former employee whose access was never removed are all common entry points. Closing that gap is what prevents the same incident from happening again.

What Happens When Businesses Wait

The damage from a cyberattack compounds with time. An attacker inside your network for days or weeks has had the opportunity to steal credentials, exfiltrate data, and position malware for later deployment. For small businesses in greater Boston the average cost of a data breach approaches $254,000, and that figure does not capture lost clients, reputational damage, or the operational disruption that continues long after the technical issues are resolved.

The businesses that recover are the ones that acted quickly and had preparation already in place. The ones that do not recover waited too long or discovered too late that their backup could not actually restore their data.

What To Do Right Now

The best time to prepare for a breach is before one happens. That means continuous monitoring, a tested backup plan, a basic incident response process, and cyber insurance that reflects your actual risk. Create a culture of cybersecurity awareness in your company so people are encouraged to "see something say something" rather than fearing "getting in trouble". Often its not obvious there's a problem immediately, so open communication is key. We've seen many recent incidents of Business eMail Compromise (BEC). The sooner someone raises the flag - "I think I clicked on something bad", the faster you'll get to remediating the problem.

At Ekaru we help small businesses across Westford, Acton, Chelmsford, Lowell, and greater Boston respond to cybersecurity incidents, recover from data loss, and build the foundations that reduce risk before something forces the conversation.

If you think something may have already gone wrong, call us today.

Business Email Compromise: A Tale of Three Businesses

Ann Westerheim — Thu, 20 Aug 2026 19:55:03 GMT

Imagine three small businesses facing the exact same cyber threat.

An attacker gets access to an employee’s email account. Maybe a password was stolen through phishing. Maybe the attacker found credentials from an earlier breach. However they got in, they now have something incredibly valuable: access to a real business email account.

From there, they can quietly watch.

They can learn who handles invoices. Who approves payments. Which vendors the company works with. How the owner communicates. They may even watch an existing email conversation and wait for exactly the right moment to step in.

This is Business Email Compromise, or BEC. And it’s one of the most financially damaging forms of cybercrime facing businesses today.

According to the FBI’s 2025 Internet Crime Complaint Center (IC3) Annual Report, Business Email Compromise was the second-highest crime type by reported financial losses, behind investment fraud. Businesses and individuals reported approximately $3.05 billion in BEC losses in 2025 from 24,768 complaints. Read the full FBI report here.

That’s billion with a “B.”

But statistics don’t always make cyber risk feel real.

So let’s look at what happens when the same kind of threat hits three different businesses.

Business #1: The Attack Is Spotted Early

We recently shared a short video about two local businesses that faced similar cybersecurity threats but experienced very different outcomes. These are real cases from local businesses. For security reasons, the actual identifying data is redacted, but you can see the key points.

In the first business, security systems provided visibility into what was happening.

Something unusual was detected.

There was an alert. There was information to investigate. And there were systems in place paying attention who could take action. - QUICKLY!

That doesn't mean the business was magically immune from cybercrime. No cybersecurity system can promise that.

What it means is that they had a chance to see the warning signs and respond before a security incident became a financial disaster.

NO emails or files accessed, sent, modified, or deleted!

That distinction matters.

Business #2: Same Threat, Very Different Outcome

The second business didn't have the same level of protection and visibility.

And that's where a Business Email Compromise can become particularly dangerous.

Once criminals gain access to a legitimate mailbox, they don't necessarily do something obvious. In fact, doing nothing for a while may be part of the plan.

They can watch.

They can read.

They can learn how the business operates.

Then, when the timing is right, an email that looks completely normal can appear in an existing conversation:

"We've changed banks. Please use these new payment instructions for this invoice."

The employee receiving that message recognizes the vendor. They recognize the conversation. The invoice may even be legitimate.

The only thing that's changed is where the money is going.

And by the time someone realizes what happened, tens or hundreds of thousands of dollars could be gone.

In this case, the user thought they may have clicked on something wrong, and called us soon after so we could run an investigation. Unfortunately, 214 emails were read, but no emails or files were sent or modified. Five were deleted, and we could identify them from the logs.

But There's a Third Business We Need to Talk About

This is the business that worries us the most.

Business #3 doesn't know there's a problem at all.

There are no meaningful security alerts being monitored. No one is looking for unusual activity in Microsoft 365. No one is investigating suspicious logins or unexpected changes inside email accounts. Sadly, this is the typical scenario for most local businesses.

Everything appears to be working just fine.

Email comes in.

Email goes out.

Employees log in every morning and get their work done.

From the business owner's perspective, everything is fine. No news is good news, right?

But would they know if someone else were inside their email?

That's the question.

For some businesses, the first cybersecurity "alert" they receive isn't an alert at all.

It's a phone call from a vendor:

"We never received your payment."

Or an employee asking:

"Did you really ask me to change that bank account?"

Or an accounting team discovering that a $50,000 invoice was paid to a criminal instead of a trusted vendor. Or one of your long term customers is tricked into paying a criminal.

That's a terrible way to discover that an email account has been compromised. Beyond the immediate financial loss, there is also loss of trust and reputation.

"We Have Microsoft 365" Isn't the Same as "Someone Is Watching"

This is an important distinction for small businesses.

Having email security features available, such as STRONG passwords and Multifactor Authentication MFA, isn't necessarily the same as having someone actively monitoring and responding to security events.

Think about a burglar alarm.

You can have sensors on every door and window in your building. But if the alarm goes off at 2:00 a.m. and nobody receives the alert, investigates it, or responds, how much protection did the alarm really provide?

Cybersecurity works the same way.

The goal isn't simply to collect more security tools.

The goal is to have the right protections and the visibility to recognize when something isn't right.

Why Business Email Compromise Works So Well

The FBI describes BEC as a sophisticated scam that often involves compromising legitimate business email accounts through social engineering or computer intrusion.

That's what makes it so effective.

The criminal doesn't always need to create an obviously fake email.

If they're actually inside someone's account, they may be able to understand the context of real conversations and use that trust against the business.

That's also why technology alone isn't enough.

Businesses need good technical protections, including multi-factor authentication and appropriate email security. But they also need strong business processes.

If a vendor suddenly asks you to send payments to a different bank account, verify the change using another trusted method of communication.

Don't simply reply to the email.
Call a phone number you already have on file. Talk to the person you normally work with. Confirm the change before the money moves.
A two-minute phone call can prevent a very expensive mistake.

Which of the Three Businesses Are You?

That's the question we'd encourage every small business owner to consider.

If someone gained access to one of your employees' email accounts today, how would you know?

Would someone receive an alert?

Would someone understand what the alert meant?

Would someone investigate?

Would someone take action?

Or would everything continue looking perfectly normal until an invoice was paid to the wrong bank account?

You don't need to become a cybersecurity expert to answer these questions.

But someone needs to be paying attention.

Ekaru Is Here to Help

At Ekaru, we work with small and midsized businesses every day, and we know cybersecurity can feel overwhelming. Our goal isn't to scare people or bury them in technical jargon.

It's to help businesses understand their risks, put practical protections in place, and know that someone is watching when something doesn't look right.

If you're not sure which of these three businesses looks most like yours, that's a great place to start a conversation.

We're happy to talk through what you have today, where there may be gaps, and what practical next steps might make sense for your business.

No scare tactics. No strings attached.

Just a conversation with a local team that wants to help keep your business, and the people who depend on it, safe.

About the author:

How to Tell If an Email Is a Scam

lhanson@ekaru.com (Linda Hanson) — Wed, 12 Aug 2026 17:08:00 GMT

Not long ago, a scam email was easy to spot. Poor grammar, generic greetings, or suspicious links that looked nothing like the brand they were pretending to be. Most people learned to recognize them and felt reasonably confident in their ability to delete them before any damage was done, but that confidence is now a liability.

Phishing emails in 2026 are professionally written, visually convincing, and increasingly personalized. They reference your name, your company, your colleagues, and sometimes details about your business that feel like they could only come from someone who knows you. They arrive from addresses that look almost identical to the real thing, and create urgency that makes you want to act before you think.

In a recent workshop hosted by Ekaru, Ann Westerheim and Linda joined Lincoln Vierhus to break down exactly how Business Email Compromise and phishing attacks work and why they are so effective against small businesses in greater Boston. You can watch the full workshop here.

One of the clearest takeaways from that conversation was this: the emails that cause the most damage are not the obvious ones, but the ones that look completely legitimate right up until the moment they are not.

So how do you actually tell the difference?

That Email From Your Bank Might Not Be From Your Bank

The display name on an email can say anything. An email can appear to come from "Microsoft Support" or your own CEO while the actual sending address is something completely unrelated. Most people never check and attackers are counting on that.

Before you respond to or act on any email, look at the full email address, not just the name displayed. Attackers register domains that are one character different from the real thing, swap letters that look similar like a lowercase L and an uppercase I, or add words like "support" or "security" to a familiar brand name. An email from microsoft-support-alert.com is not from Microsoft. An email from your.ceo.name@gmail.com is not from your CEO.

Legitimate Organizations Do Not Ask You to Act Before You Think

Phishing emails are not designed to inform you, they are designed to move you. Every element of a well-crafted phishing email, the urgency, the authority, the consequences of not acting, exists to get you to do something before your instincts have a chance to catch up.

If an email is pressuring you to click, call, confirm, or transfer before you have had time to think clearly about whether the request makes sense, that pressure itself is the red flag. Legitimate organizations rarely ask you to click a link to verify your account, confirm a payment, or provide login credentials in response to an unsolicited email. Any email that creates pressure to act immediately is worth slowing down on regardless of how legitimate it looks.

The Link That Looks Safe Might Be the One That Is Not

Attackers do not need you to visit an obviously suspicious website. They need you to visit one that looks completely legitimate right up until the moment your credentials are captured or your device is compromised. The difference between the real site and the fake one is often a single character in the URL that nobody checks.

Hovering over any link before clicking reveals the actual destination address at the bottom of your browser or email client. If it does not match the organization sending the email, do not click it. This habit takes two seconds and stops the majority of phishing attempts cold.

The Details Attackers Get Wrong Are the Ones Most People Miss

A busy inbox is an attacker's best friend. When you are moving fast, a subject line that does not quite match the email body, a salutation that uses your email address instead of your name, or formatting that is slightly off compared to legitimate communications from the same brand are easy to miss. They are much harder to miss when you make a deliberate habit of slowing down before acting on any email that asks you to do something unusual.

The question to ask is not just whether the email looks real, but whether this request makes sense coming from this person at this moment.

If Something Feels Off, It Probably Is

Attackers are skilled at creating emails that pass a quick glance but carry a subtle wrongness when you slow down and examine them. A request that does not fit the relationship, a tone that is slightly different from how a known contact normally writes, or a timing that does not make sense given where things stand.

Most people who fall for phishing attacks report afterwards that something felt slightly off but they acted anyway because the email looked professional and the request seemed plausible. That hesitation is worth listening to every single time.

When in doubt, verify through a separate channel. If you receive an email from your bank, your IT provider, or a colleague asking you to take an unusual action, call them directly using a number you already have, not one provided in the email, and confirm the request is legitimate before proceeding.

The Attack That Looks Like a Normal Email From Someone You Trust

Business Email Compromise does not arrive with a warning. It arrives looking like a routine message from your CEO, your accountant, your vendor, or your bank. It asks for something that is slightly unusual but not impossible. A wire transfer that needs to happen today, a change to payment details before an invoice goes out, or access to a file that someone urgently needs.

By the time the request is questioned the money is already gone or the access is already granted. For small businesses in greater Boston without formal verification processes for financial requests, this attack works because it exploits trust rather than technology.

In Ekaru's workshop, Lincoln Vierhus illustrated how these attacks unfold step by step and what makes them so effective against small businesses that do not have formal processes for verifying unusual financial requests. The answer is not complicated technology, but a simple verification habit applied consistently.

What Small Businesses in Greater Boston Should Do

The businesses that avoid these attacks are not the ones with the most sophisticated technology. They are the ones where every person on the team knows what to look for, feels confident enough to pause before acting, and knows exactly who to call when something does not feel right.

Does your team have that confidence right now? If you are not sure, that is worth finding out before an attacker finds out for you.

At Ekaru we help small businesses across Westford, Acton, Chelmsford, Lowell, and greater Boston build the security awareness and technical defences that reduce the risk of phishing and Business Email Compromise. From email filtering and security monitoring to staff training and incident response planning, we handle the protection so your team can focus on the work.

If you want to see exactly how these attacks work and what your business can do to stop them, our full workshop on Business Email Compromise and phishing is available now. Watch it at the link below and share it with your team.

https://www.youtube.com/watch?v=-4TdGcMg-eg

And if you want to know how well your current email security would hold up against a real attack, a free IT assessment is the fastest way to find out.

Why Is My Computer So Slow? (And what to do about it)

lhanson@ekaru.com (Linda Hanson) — Thu, 30 Jul 2026 14:21:10 GMT

Why Is My Computer So Slow? And What To Do About It

You sit down to start your day, open an application, and spend the next several minutes watching a progress bar that does not seem to be progressing. It is one of the most common frustrations in any workplace and for small businesses it is more than an inconvenience. Every minute your team spends waiting on a slow machine is a minute they are not serving clients, moving work forward, or doing what you are actually paying them to do.

The good news is that slow computers usually have a reason behind them, and most of those reasons are fixable. Here is what is actually going on and what you should do about it.

Too Many Programs Running in the Background

Every time you turn on your computer, a list of programs launches automatically without you seeing it happen. Antivirus software, cloud sync tools, communication apps, software updaters, and dozens of other applications are all competing for your computer's memory and processing power before you have even opened a single browser tab.

For small businesses running older hardware, this alone can be the difference between a computer that feels responsive and one that feels like it is working against you. The fix starts with reviewing your startup programs. In Windows, open Task Manager with CTRL + SHIFT + ESC, navigate to the Startup tab, and look at what is set to run automatically. Anything your team does not use immediately upon starting the computer does not need to be launching every single morning.

Your Storage Is Almost Full

Windows needs a certain amount of free space on your hard drive to operate efficiently. When storage drops below ten to fifteen percent of total capacity, performance degrades noticeably and files take longer to open, applications take longer to load, and the whole system slows down in ways that feel random but are entirely predictable.

For small businesses storing large files, client documents, emails, and application data locally on individual machines, storage fills up faster than most people realize. The solution is partly cleanup and partly a longer conversation about where your business data should actually be living. If your team is still saving everything to individual desktops rather than a shared cloud environment, you likely have a storage problem and a backup problem at the same time, and that is a conversation worth having with your IT provider before a drive failure makes it urgent.

Your Hardware Is Too Old for What You Are Asking It to Do

Software requirements grow over time and the computer that handled everything your business needed four years ago may genuinely not have the processing power or memory to run today's applications at an acceptable speed. Microsoft 365, modern browsers, video conferencing tools, and security software all consume significantly more resources than their predecessors did.

A computer running on four gigabytes of RAM purchased in 2018 is not going to perform like a modern machine regardless of how much you clean it up. For small businesses in greater Boston, aging hardware is one of the most common and most overlooked causes of productivity loss. The cost of replacing a machine feels significant until you calculate what your team's time is actually worth per hour and how much of it is being lost to a slow computer every single day.

Your Computer Has Not Been Properly Maintained

Computers require ongoing maintenance to perform at their best. Security patches need to be applied, drivers need to be updated, temporary files accumulate and need to be cleared, antivirus definitions need to stay current, and disk fragmentation on older hard drives compounds over time.

For small businesses without a dedicated IT team, this maintenance simply does not happen consistently because nobody has time to do it and nobody has been told it needs doing. The result is a computer that degrades gradually until the slowdown becomes impossible to ignore. This is one of the clearest illustrations of why proactive managed IT support for small businesses makes a measurable difference. A managed IT provider handles this maintenance continuously and automatically so your team never needs to think about it and the performance impact compounds positively over time rather than negatively.

Something More Serious May Be Going On

Not every slow computer is a hardware or maintenance problem. Malware, spyware, and other malicious software running in the background can consume significant system resources while operating completely invisibly, and a computer that has become dramatically slower without an obvious reason is worth investigating beyond the standard fixes.

For small businesses in Massachusetts handling client data, financial information, or protected health information, a compromised machine is not just a performance issue. It is a security incident and potentially a compliance issue depending on your industry. If your antivirus software is current and your computer is still inexplicably slow, that warrants a conversation with your IT provider rather than another restart and a hope for the best.

When a Slow Computer Is a Sign of Something Bigger

A single slow computer is often an isolated issue but multiple slow computers across your office is a different conversation entirely. If your entire team is experiencing performance problems, the issue may be network-related rather than device-specific. Bandwidth limitations, router configuration, network congestion, or a poorly configured server can all manifest as individual computers feeling slow when the real problem sits elsewhere in your infrastructure.

This is exactly the kind of diagnostic work that requires someone who knows what they are looking at. A slow computer that is actually a network problem will not be fixed by cleaning up startup programs or adding memory to individual machines, and diagnosing it incorrectly costs time and money that could have been spent solving the actual issue.

What You Should Do

Start with the basics. Restart your computer fully rather than leaving it in sleep or hibernate mode, check your startup programs and disable anything unnecessary, clear your temporary files, and make sure Windows and your applications are fully updated.

If those steps do not make a meaningful difference, the problem likely requires a more thorough evaluation. Hardware age, storage configuration, network infrastructure, and security posture all play a role in how your computers perform day to day and getting to the real cause usually requires someone who knows what to look for.

At Ekaru, we provide managed IT services for small businesses across Westford, Acton, Chelmsford, Lowell, and the greater Boston area. We handle the ongoing maintenance, monitoring, and proactive support that keeps your team's computers running the way they should so your business does not slow down with them.

Not sure whether your computers are a hardware problem, a maintenance problem, or something more serious? That is exactly what we help small businesses figure out. Reach out today and we will take a look.

Windows July 2026 Patch Tuesday: What Small Businesses in Greater Boston Need to Know

lhanson@ekaru.com (Linda Hanson) — Fri, 17 Jul 2026 19:25:08 GMT

Microsoft released its July 2026 Patch Tuesday security update yesterday, and the numbers are impossible to ignore.

570 vulnerabilities addressed in a single release. That is not a typo. It is the largest Patch Tuesday in Microsoft's history, and it raises a question every small business owner in greater Boston should be sitting with right now: how confident are you that your devices are actually being managed?

At Ekaru, we provide proactive managed IT services for small businesses across Westford, Acton, Chelmsford, Lowell, and the greater Boston area. Every Patch Tuesday we break down what was fixed, what it means in plain English, and what your business needs to do. This month, that conversation is more important than it has ever been.

Why 570 Vulnerabilities Should Make You Uncomfortable

Part of the reason July's number is so large is that Microsoft has begun using an AI-powered vulnerability discovery system to find security flaws across its Windows codebase before attackers can. In other words, the threats have always been there, but the difference now is that they are being identified and disclosed faster than ever before.

That is good news for businesses that are patching promptly, but is a significant problem for businesses that are not.

Of the 570 vulnerabilities fixed this month, 59 are rated Critical. Two were already being actively exploited in real attacks before the patch was released. One was publicly disclosed, meaning it was known to attackers before a fix existed.

If your devices have not been updated, some of those vulnerabilities are probably open right now.

The Vulnerabilities Worth Understanding

Three areas stand out this month for small businesses in Massachusetts.

The first is Active Directory Federation Services, where an actively exploited zero-day allowed attackers to gain administrative privileges. If your business uses Microsoft's identity and access management systems, including single sign-on for cloud applications, this is the kind of vulnerability that puts everything behind your login screen at risk. The flaw was discovered by Microsoft's own incident response team, which suggests it was found while investigating live attacks.

The second is Microsoft SharePoint Server, where another actively exploited zero-day allowed an unauthorised attacker to gain elevated privileges over a network without authentication. SharePoint is widely used by small businesses for document management, team collaboration, and internal communications. An unauthenticated attacker gaining elevated access to that environment is not a theoretical risk.

The third is Windows BitLocker. A publicly disclosed bypass allows an attacker with physical access to a device to circumvent full disk encryption and access the data on it. For small businesses that rely on BitLocker to protect laptops, particularly relevant when devices are travelling with employees over summer, this patch is not optional.

Beyond these three, July's update also addresses critical vulnerabilities in Microsoft Office, including Word, Excel, PowerPoint, and SharePoint, as well as Windows DHCP, Remote Desktop Services, Hyper-V, and Microsoft Defender itself. The scope of this release touches nearly every piece of software a typical small business relies on daily.

The Question Most Small Business Owners Cannot Answer

Here is what this month's Patch Tuesday actually reveals about how most small businesses approach IT.

Most are not patching promptly. Research consistently shows that the gap between a vulnerability being disclosed and it being exploited at scale is shrinking. With AI now accelerating both vulnerability discovery and attack automation, that window is narrowing further.

Most do not know what is running on their network. The 570 vulnerabilities in this month's release span Windows, Office, Azure, Exchange, SharePoint, SQL Server, Hyper-V, Defender, and dozens of supporting components. Do you know which of those your business relies on? Do you know which of your devices are running outdated versions? Do you know which ones have not restarted in weeks?

Most assume someone is handling it. And sometimes that assumption is correct. But assumption is not the same as verification, and when a vulnerability is being actively exploited in the wild, there is no safe margin for assumption.

What This Means for Small Businesses in Greater Boston

The businesses that avoid serious incidents are not the ones that got lucky. They are the ones that have a systematic, consistent approach to patch management that does not depend on someone remembering to click update.

July 2026 Patch Tuesday is a useful moment to ask some honest questions about your current setup. When were your devices last fully updated? Who is responsible for verifying that updates actually complete? What happens when a device fails an update silently? Is there a process for that, or does it go unnoticed until something breaks?

If you are not sure of the answers, that gap is worth understanding before something forces you to.

Ekaru Keeps Greater Boston Businesses Protected

The Ekaru team monitors and manages Windows updates for small businesses across Westford, Acton, Chelmsford, Lowell, and the greater Boston area. Our managed IT services include patch management, device monitoring, compliance tracking, and proactive security support so your business is protected before a vulnerability becomes an incident.

If you have questions about this month's update or want to know where your business actually stands, a free IT assessment is the fastest way to find out. No obligation, no jargon, just honest answers from a local team that genuinely cares about your business.

🌐 ekaru.com | 978-692-4200