Small business cyberattacks keep rising. Here is why attackers go after smaller companies and what makes them easy to hit.
Small business cyberattacks happen every day. Attackers go where the money is easiest to reach, and small companies often hold real money and real data behind very little protection.
Verizon’s 2025 breach report found that small and medium businesses had about four times as many confirmed breaches as large organizations. Sophos found ransomware in 70% of the small business incident response cases it handled. Employees at companies with fewer than 100 staff also face 350% more social engineering attacks than employees at large enterprises. The reasons come down to money, defenses, and people.
What Attackers See in a Small Business
From the outside, a small business looks a lot like a big one. It has customer records, bank accounts, payroll, and vendors it pays on a schedule. The difference is what stands in front of all that.
Most small companies have no security team, and often nobody handles IT full-time. Updates wait until someone is available. Only 20% of small businesses use multi-factor authentication, which is one of the cheapest protections there is. And 87% of them hold customer data that could be stolen.
That makes the math easy for attackers. Breaking into a large company can take months. A small one can fall to a single phishing email or an unpatched plugin. Ransomware groups have automated much of this work and aimed it at smaller targets because they put up less of a fight.
Each small business pays out less than a big one would. Attackers make up for that with volume. Hitting a hundred small companies costs them little more than hitting one, and the money adds up.
How Most Attacks Start
Most attacks start with an email. An employee in accounts might receive a message that appears to come from the owner, asking for an urgent payment. Or an invoice arrives from a real supplier with a changed bank account number.
Small teams are more exposed to this because people know each other and tend to trust familiar messages. One person often handles payments from start to finish, with nobody reviewing their work. Only 42% of small businesses provide cybersecurity training for employees, so the person who opens the email may never have been shown what a fraudulent one looks like.
AI tools have made these emails more convincing. Attackers no longer need technical skill to write a believable message, since ready-made tools can produce one for them.
Unpatched software is the other common way in. One 2026 analysis found that software vulnerabilities caused 31% of breaches, which made them the most common entry point. Attackers can scan for outdated systems automatically, so a small business running old software can be found without anyone choosing it as a target.
What an Attack Costs
The direct cost of an attack varies a lot with company size and the type of attack. One 2026 analysis of small businesses in North America put the average loss at $254,000 per breach. That figure comes from a security vendor, so treat it as an estimate. Even so, it is a large amount for a company with a few dozen employees.
The ransom is only part of the bill. A company that loses access to its systems also pays for the days it cannot operate, the work of restoring data, and the time spent notifying customers. Detection is slow as well. The same analysis found that businesses with up to ten employees took 48 to 96 hours to notice an intrusion.
Recovery is difficult without outside help. Only 27% of small businesses fully recovered their data without assistance from a third party, which means most of them end up paying specialists on top of everything else.
Some types of business carry more risk than others. Firms that hold confidential client information, such as law firms, accountants, and insurers, are frequent targets because they also have access to clients’ financial accounts. Healthcare and financial services made up 44% of small business ransomware targets.
What a Small Business Can Do
Most of the defenses that matter are inexpensive and do not need a dedicated security team.
Multi-factor authentication is the first place to start. Only 20% of small businesses use it, and it stops many attacks that rely on stolen passwords. Turn it on for email, banking, and any system that holds customer data.
Updates come next. Since software vulnerabilities were the most common way into small businesses in 2026, set systems to update automatically wherever possible. For anything that cannot update itself, someone should be assigned to check it on a fixed schedule.
Payment requests need a second check. If an email asks for a transfer or a change to a supplier’s bank details, confirm it by phone using a number you already have. This one habit would stop most business email fraud, which the FBI estimates costs small businesses around $120,000 per incident.
Training does not have to be elaborate. A short session twice a year, with examples of real phishing emails, gives employees something to compare against when a suspicious message arrives. Since 42% of small businesses provide any training at all, a company that does it is already ahead of most.
Backups deserve a regular test. A backup that has never been restored may not work when it is needed. Keep at least one copy offline so ransomware cannot reach it.
Finally, write down what to do when something goes wrong. A single page listing who to call, which systems to shut off, and where the backups are kept is enough. Small business cyberattacks are common enough that having a plan is part of running the company.
Enjoyed this article?
Let’s talk about how a focused outsourcing partner can move your roadmap forward.
