TL;DR:

  • USB drop attacks — leaving infected USB drives in places staff might pick them up — remain an active threat; a significant proportion of people who find a USB drive plug it in without checking
  • Physical security gaps (unlocked offices, unsupervised visitors, unshredded documents) create opportunities that require no digital skill to exploit
  • The mitigations are straightforward: USB port policy, staff awareness, and basic physical access controls

When people think about cyberattacks on small businesses, they picture phishing emails and ransomware downloads. Physical attacks — ones that require an attacker to enter or approach your premises — get less attention. That’s partly because they’re less common at scale than digital attacks, and partly because they feel less “cyber.” But they work, they target small businesses specifically, and they require almost no technical sophistication from the attacker.

What Is a USB Drop Attack?

A USB drop attack (also called USB baiting) works like this: an attacker places a USB drive in a location where your employees are likely to find it — the car park, the reception desk, the kitchen counter, the meeting room table. The drive is often labelled to provoke curiosity: “Q2 Salary Review”, “Redundancy List”, “Client Contracts”, or left unlabelled as if dropped accidentally.

When an employee plugs in the drive, the malware on it executes automatically (via autorun techniques on older systems) or through social engineering (files that ask the user to enable macros or click to run). The result can be a keylogger, a backdoor, ransomware, or credential harvesting software installed on the machine.

Research conducted by Comparitech and security researchers over several years consistently shows that 45–60% of people who find a USB drive plug it into a work or personal computer, particularly if the label suggests the content is interesting. The attack doesn’t require your email security to fail, your staff to miss a phishing indicator, or your software to be unpatched. It requires someone to find a USB drive and be curious.

Who Targets Small Businesses with Physical Attacks?

For organised criminal groups, targeted physical attacks on specific small businesses are rare — the economics usually favour mass phishing over targeted physical intrusion. The real risk for small businesses comes from:

Opportunists. Someone who walks into an unlocked office, café, or reception area can take an unattended laptop in seconds. A laptop left visible in a parked car is a frequent target.

Competitors or disgruntled former staff. Motivated individuals with prior knowledge of your premises and systems may use physical access to plant malware or access systems directly. Former employees who kept a key or access card are a specific variant of this threat.

General criminals who’ve added a digital dimension. Physical break-ins increasingly include looking for anything of value — and an unlocked computer or a Post-it with passwords has value.

Curiosity-driven employees (internal). This isn’t an external threat, but staff plugging found drives into company computers, or taking photos of screens for personal use, creates real exposure.

The Most Common Physical Security Gaps in Small Businesses

Unlocked premises during the working day. Reception areas, client waiting rooms, and shared workspaces with public access all represent environments where an outsider can access desk areas, plug in a device, or photograph a whiteboard. Many small businesses have minimal controls during business hours.

Unattended devices. Laptops left open on desks, reception computers without screen locks, and phones left unlocked in meeting rooms all create quick-access windows for anyone who enters unattended.

Unsupervised visitors. Contractors, delivery personnel, and “lost” visitors who wander into the office unsupervised can access areas that employees take for granted. A maintenance engineer in a server room or comms cupboard with no supervision is a risk.

Physical documents. Contracts, HR files, invoices, and financial statements left on desks or in unsecured bins contain information that supports identity fraud, invoice fraud, or targeted phishing.

Printouts and whiteboards. Printers with uncollected documents are a significant source of leaked information in shared office buildings. Whiteboards photographed by visitors expose meeting content.

What to Do: Practical Controls

Disable USB ports on company computers via group policy. This is the most effective mitigation for USB drop attacks. In Windows, you can use Group Policy (Computer Configuration → Administrative Templates → System → Removable Storage Access) to block removable storage devices. IT Managed Service Providers can implement this across your fleet easily. Legitimate peripherals (keyboards, mice, wired headsets) use HID device classes that can be permitted separately while blocking storage devices.

If disabling USB entirely isn’t practical, configure Windows Defender to scan removable media automatically before it can be accessed, and educate staff never to plug in a drive they didn’t personally buy or receive from a known source.

Run a USB baiting drill. Buy a handful of cheap USB drives, label them with tempting labels, and leave them around your premises. See how many end up plugged into computers. Track the results (without punishing individuals) and use them to drive a team conversation about the threat. The NCSC’s Exercise in a Box programme includes social engineering scenarios.

Lock screens automatically and enforce it. Windows and macOS both support automatic screen lock after a defined inactivity period. For most business environments, 3–5 minutes is reasonable. Push this as a policy via group policy or MDM. Physical privacy screens on monitors facing public areas are a cheap additional control.

Visitor management. Require all visitors to sign in, be issued a visitor badge, and be escorted in areas beyond reception. This is standard practice in larger organisations and is equally sensible for small offices. “Piggybacking” — following an authorised person through a secured door — should be politely challenged by staff.

Secure shredding. Use cross-cut shredders for any document containing names, account numbers, contracts, or financial information. Bags-for-life sitting next to the recycling bin with printed documents visible in them are not a hypothetical risk.

Laptop security when out of office. Enforce full disk encryption (BitLocker on Windows, FileVault on Mac) so a stolen or lost laptop’s data is inaccessible. Never leave laptops visible in vehicles — put them in the boot before arriving at any destination. Physical Kensington locks for devices used in shared spaces are a deterrent against opportunistic theft.

Document your physical security risks. Walk through your premises as if you were an outsider. Where could someone walk in unannounced? Where are devices visible and accessible? Where are documents stored unsecured? A 30-minute walk-through once a year often surfaces straightforward fixes that nobody had thought to make.

Physical security doesn’t need to be complex to be effective. The most common physical attacks on small businesses succeed because of habits — propped doors, unlocked screens, found USB drives plugged in without a second thought — rather than because of sophisticated circumvention of technical controls. Changing those habits is cheap and doesn’t require specialist knowledge.