Strategies for Organizations to Resist DDoS Attacks Without Paying Ransoms

My buddy works for a small online store, and their site got taken down by a DDoS attack last month. They got a ransom demand, but obviously didn’t want to pay. Does anyone know if there’s a practical way to fight back against these attacks, or is it just something only huge companies can deal with?