Nobody hacks most passwords. They buy them. 24 billion+ stolen logins are for sale right now (Digital Shadows). Reuse one password and a single old leak opens your email, bank, and business. Break the chain: https://buymeacoffee.com/pcaloca/e/533150

Ransomware is the one that closes creative businesses. 88% of small-biz attacks involve it (Verizon 2025). Median demand: $500K. Most who pay don't get everything back. A tested backup + a plan beat it.

Ever sent a client an invoice? Then you're a data holder — legally. Every U.S. state has a breach notification law, most with no "too small" exception. Leak client data and the clock to notify can start at 72 hours. Be ready.

"Why would anyone hack me? My art isn't worth stealing." The bad guys agree. They don't want your art. They want your money, your client list, and the logins that open everything else. Know what's exposed.

You're not too small to be hacked. You're the easy target. No IT team, no cyber insurance, no plan — and 93% of attacks on small businesses are after your money, not your art. A plan decides how bad it gets: https://buymeacoffee.com/pcaloca/e/533150

Old client data is not a keepsake. It's a liability with a nostalgia filter. Today: delete 1 folder, spreadsheet, or export you no longer need. If you don't have it, it can't be breached. Tomorrow: we'll turn this into a repeatable cleanup habit.

Your memory is not a forensic tool. It's a soggy napkin with confidence. Today: start an incident log now: time, what happened, actions you took, who you called. Future You, your insurer, and possibly a lawyer will thank you. Tomorrow: the cleanup step most people skip.

Ransomware screen? Don't play detective yet. First move: disconnect from Wi-Fi or unplug the network cable. Cut the machine off before you click around like a nervous raccoon in a studio. Tomorrow: what not to do next, even if the ransom note is being dramatic.

Getting your email back isn't the finish line. Attackers may leave forwarding rules behind, like a creepy studio assistant reading every message. Today: check email settings for forwarding/filters you didn't create and delete them. Tomorrow: the first move when ransomware appears.

A stolen laptop shouldn't become a client data incident. Today: turn on FileVault on Mac or BitLocker/Device Encryption on Windows, then save the recovery key somewhere safe. Tiny toggle, big “nice try” energy. Tomorrow: the sneaky email setting attackers love.

Your email is the master key. If it falls, password resets, client chats, and invoices line up like ducks with bad judgment. Today: turn on two-step login for email, preferably with an authenticator app. Tomorrow: one setting that makes a stolen laptop less exciting.

Ransomware loves a plugged-in backup drive. Today: after your backup finishes, eject the drive and unplug it. Every time. Three seconds, zero drama, much less “why is my portfolio encrypted?” Tomorrow: we protect the account that unlocks everything.

A backup you haven't tested is a polite fiction. Today: restore 1 client file to a different folder and open it. If it works, breathe. If it doesn't, fix it while coffee is still an option. Tomorrow: the 3-second habit ransomware hates.

Crisis brain is a terrible search engine. If your email is locked, don't make Future You Google bank fraud numbers like a raccoon with Wi-Fi. Today: print your bank, insurer, internet provider, and trusted tech helper contacts. Tomorrow: we make backups less dramatic.

Your incident plan shouldn't live only in your head. Heads are great for ideas, terrible filing cabinets at 11 p.m. Today: write your bank, insurer, and trusted tech helper on paper. Tomorrow: the backup move that saves businesses.

Most people think Maps is for directions. It's also a travel diary with a clipboard. Google Maps > profile icon > Your Timeline and Location sharing. Delete old trips, pause Timeline, and remove location sharing you don't need. Be findable by choice.

Most people think Chrome sync is convenience. It's also a conveyor belt. Chrome > Settings > You and Google > Sync > Manage what you sync. Turn off history, tabs, and passwords if you don't need them everywhere. Save this for your 2-minute privacy cleanup.

Most people think old Google activity is harmless. It's a diary with ad budget. Google Account > Data & privacy > My Activity > Delete. Clear old activity, or set auto-delete to 3 months. Save this for your next 2-minute privacy cleanup.

Most people think Google privacy is a scavenger hunt. Make it a checklist: Google Account > Data & privacy > Privacy Checkup. Tighten each section. Your studio doesn't need a landlord with binoculars. Save this for your next 2-minute privacy cleanup.

Most people think Google search is neutral. It's a question box with a memory. Set DuckDuckGo, Brave Search, or Startpage as your browser default today. Your client research doesn't need a corporate stenographer.

Most people think personalized ads are helpful. They're billboards with a clipboard. Google Account > Data & privacy > Personalized ads > My Ad Center > turn off personalized ads. Save this for your next 2-minute privacy cleanup.

Most people think Maps is giving directions. It's also taking notes. Google Account > Data & privacy > Location History > Turn off. Your client meeting, coffee stop, and supply run don't need a corporate biographer. Save this for your 2-minute privacy cleanup.

Most people think YouTube History is harmless. It's a watchlist with ads attached. Google Account > Data & privacy > YouTube History > Turn off. Your 2 a.m. lens-review spiral doesn't need a permanent file. Save this for your next 2-minute privacy cleanup.

Most people think Google privacy is a grand strategy. Start with one switch: Google Account > Data & privacy > Web & App Activity > Turn off. Your search history doesn't need a full-time archivist. Save this for your next 2-minute privacy cleanup.

At 11 p.m., your brain is not a help desk. Print your incident plan: contacts, accounts, backups, devices, insurance, recovery info. Don't trap the only copy in the laptop or inbox you may need to recover. Paper beats panic.

If you have clients, you have data. Names, emails, invoices, contracts, and booking forms can trigger breach duties if exposed. Know what you collect and where it lives. Add this to your plan before the clock starts.

A stolen laptop should be a hardware loss, not a client data emergency. Turn on FileVault or BitLocker. Set up Find My or remote erase. Keep serial numbers handy. Prepare before your laptop takes an unauthorized vacation.

Your email is the master key wearing sweatpants. If it's taken over, use the official recovery page, change the password, sign out sessions, and check forwarding rules. Plan this before someone starts doing theater as you.

Ransomware first step: don't restart like the computer owes you money. Disconnect internet. Leave it on. Photograph messages. Call your trusted tech helper. Put this in your plan before panic gets a vote.

Your IT department is you, a laptop, and a charger with commitment issues. Write a cyber incident plan now: who to call, where backups live, what to unplug, and which accounts matter first. Prepare before the bad day arrives.