What sort of IT infrastructure do they usually have? - My gut reaction was that they wouldn't have a need for a server in the first place, but I guess that depends on how small it is. A simple file-share though, would be rather vulnerable to this.