What can be done to stop these attacks, especially if there is no funding for extra IT help?

A three-pronged strategy focused on people, process, and technology is vital.