This week I wrote up a real campaign: a China-linked group called Vapor Panda pointed an AI hacking tool named ARTEX at more than 200 organizations in about eleven days. The targets were foreign ministries, defense contractors and semiconductor firms, the kind of names that feel a world away from a small business. But the part that stuck with me was not the targets. It was the speed. One operator, with an AI doing most of the work, swept through hundreds of organizations in the time it used to take to break into one.
So let me bring it down to earth with a made-up business, because the lesson lands harder when the target looks like someone you know.
Meet Meridian Dental
Meridian Dental Group is not real, but you have been to a dozen places just like it. Forty staff across four locations. A WordPress website with an online appointment form. A patient portal added through a third-party plugin. A cloud practice-management system that holds the patient records. Microsoft 365 for staff email. And one part-time IT contractor who comes in when something breaks.
For years, a place like Meridian was safe for a simple reason: economics. A human burglar only has so many hours, so they spend them on big houses. Breaking into a dental office by hand was not worth the effort. That is the assumption an AI tool quietly destroys.
Why the robot changes the math
Picture ARTEX not as a single clever hacker but as a small, tireless crew that never sleeps. One “manager” agent hands out jobs. “Planner” agents decide what to try next. “Worker” agents do the actual poking and prodding. They share what they learn as they go, and they work on many targets at once. In the real Vapor Panda case, a single intrusion burned through roughly 1.4 billion words of AI processing. That is the scale we are talking about.
Here is the key point for Meridian: the office is not being singled out. It is simply item number 147 on a list the AI is grinding through. The attacker never has to decide Meridian is “worth it,” because the tool makes going after everyone nearly free.
How it would try the doors
None of what follows is exotic. It is the same burglary, run faster and wider.
First, it looks around. The agents catalog everything Meridian has facing the internet: the website, the portal login, the mail server, even a forgotten old page like test.meridiandental.com that someone set up years ago and never took down. They note exactly which version of WordPress and which plugins are running, then check those against public lists of known weaknesses. A person could do this too. The difference is the AI does it for Meridian and 199 other offices before lunch.
Then it looks for the easy door. It is not hunting for some brilliant new trick. It wants the one plugin nobody updated, the appointment form that was built sloppily, the staff login page with no second step beyond a password. It only needs Meridian to have skipped one update.
If the doors are locked, it tries the people. The “Meet Our Team” page kindly lists every staff member by name, which is enough to guess their email addresses. The agents then try a handful of common passwords, things like a season and a year, across all of those accounts at once. Trying a few passwords against many people, rather than many passwords against one person, keeps them under the radar of lockout alarms. One receptionist reusing a weak password is all it takes.
Once inside, it settles in quietly. It plants a hidden way back in, so that even if Meridian later fixes the original hole, the attacker can still return. In the real campaign, this is where the crew installed a backdoor and told the agents to tiptoe around the security software.
Finally, it cashes out. It maps the internal network, finds the patient database, and quietly copies it. For a dental office that means thousands of records with names, birthdates, Social Security numbers and insurance details. That is both a serious privacy-law violation and a tempting setup for a ransom demand.
The hopeful part
When I wrote McAfee’s original Virus Informer newsletter, the viruses came on floppy disks and the advice was “watch what you put in your machine.” The tools have changed past recognition. The defenses have not. An AI burglar is fast and patient, but it still walks through the same unlocked doors a human would. It just finds them quicker. That means the boring basics matter more now, not less.
What a small business can do
- Turn on two-step login everywhere. Especially for staff email and the patient portal. This one step alone stops the password-guessing stage cold. An authenticator app or a security key beats a text message, but any second step beats none.
- Update promptly, and delete what you do not use. Set WordPress and its plugins to auto-update, and remove any plugin, page or old subdomain nobody needs. These tools live on forgotten, out-of-date software.
- Kill the reused password. Give every staff member a password manager so that “Spring2026!” never exists in the first place. One weak, reused password is the single most common way in.
- Watch the front door. Set the system to lock out and alert after repeated failed logins. That turns a quiet guessing spree into a noisy alarm you can actually respond to.
- Keep people to only what they need. The receptionist’s account should not be able to reach the full patient database. If it is compromised, the damage stops at their desk.
- Back up offline, and test it. A backup the attacker cannot reach turns a ransom demand into an afternoon of restoring files. A backup you have never tested is just a hope.
- Know what faces the internet. You cannot protect the forgotten test page you do not remember exists. Make a list of everything with your name on it that is reachable from outside, and keep it current.
The uncomfortable headline is that “we’re too small to bother with” has quietly stopped being true, because the cost of bothering has dropped to almost nothing. The comforting footnote is that the locks that work are the same ones that always worked. If you want plain-English walkthroughs of any of the steps above, that is exactly what I collect over at ransomwear.org.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
