They’ll Hack You, Lock You Out, and Charge You for It
How Small Businesses, Including Vacation Rentals and B&Bs, Get Screwed Every Day
Forty-three percent of all cyberattacks target small businesses. That’s almost half. And yet most owners think it won’t happen to them. Until it does.
I know because it happened to me. Back in the 1990s, when I launched my first vacation rental service, a so-called “friend” who built my website ended up holding my database hostage. His demand? A percentage of my business in exchange for what was already mine. That was my first brutal lesson in how quickly trust can turn into leverage.
Fast forward to today. A property management company I know tried to move their marketing to a new agency. The hosting firm they’d been with for 8 years retaliated by locking them out of their Google Ads account. Eight years of loyalty, wiped out in a power play.
The predators in plain sight
Exploitative hosts cut corners on security, skip basics like SSL and DMARC, and then act like it’s your fault when hackers slip in. Some people deliberately keep admin rights to your site or domain, preventing you from leaving.
Predatory agencies promise “guaranteed growth,” bury you in fine print, and hold your ad accounts hostage. They don’t care if your campaigns fail. They care that you keep paying.
Scammers invent fake portfolios, inflate metrics, or impersonate your business to siphon off trust and cash. And they bank on you being too busy to notice until it’s too late.
One hard-hitting example
A Cape Cod whale-watching company lost bookings after hackers broke in through a plugin vulnerability. No warning, no mercy, just gone revenue. Multiply that across thousands of small businesses that rely on cheap hosting and shady providers; the fallout is massive.
What to do now
Own your assets. Your domain, hosting, analytics, and ad accounts should all be in accounts you control. Not your “web guy,” not your agency, not your host.
Demand real transparency. If there’s no contract, no reporting, or no admin access, walk away.
Stay skeptical. Anyone promising guaranteed results is lying. Period.
Verify, don’t trust. Check portfolios, call references, and confirm access before you sign anything.
Quick Explainer
SSL/TLS: The little lock in your browser. Keeps customer data safe.
SPF, DKIM, DMARC: Email protections that keep scammers from sending fake emails under your name.
The bottom line
Small businesses are easy prey because we’re busy, trusting, and stretched thin. But you can stop being a target.
If you don’t own your accounts, you don’t own your business. Period.
How we handle it at Smart Pineapple
This isn’t a pitch. It’s how we work. We don’t lock clients into lifetime retainers. We’d rather teach you how to fish. When you understand your marketing and your digital assets, you’re not just safer — you’re sustainable. And that’s the whole point.