While small businesses form the backbone of the economy, they are also the primary target of cybercriminals, facing an onslaught of attacks that have surged by over 400% in recent years and can lead to devastating financial losses or even closure.
Key Takeaways
- 43% of cyber attacks target small businesses despite them representing only 99.9% of all US firms with fewer than 500 employees
- In 2023, small businesses experienced a 424% increase in ransomware attacks compared to 2022, affecting 66% of SMBs surveyed
- 61% of small and medium-sized businesses reported at least one cyber incident in the past year as of 2024 data
- Phishing comprises 36% of all SMB cyber attacks in 2023 Verizon DBIR update
- Ransomware affected 66% of small businesses via email vectors in 2023 Ponemon study
- DDoS attacks made up 22% of incidents against SMBs in 2023 Cloudflare data
- Average cost of cyber attack to small business is $25,000 per incident in 2023
- Ransomware payments by SMBs averaged $1.54 million globally in 2023 Sophos
- 60% of small businesses suffer $100,000+ losses from BEC scams annually
- 60% of small businesses fail within 6 months of a major cyber attack
- 51% of SMBs experienced operational downtime exceeding 24 hours post-attack 2023
- Loss of customer trust post-breach affects 75% of SMBs long-term
- Only 26% of small businesses have cyber insurance coverage in 2024 surveys
- SMBs with MFA enabled reduced account compromise by 99% per Microsoft 2023
- Regular backups helped 58% SMBs recover without paying ransom 2023 Sophos
Small businesses are increasingly targeted by devastating cyber attacks worldwide.
Attack Frequency and Prevalence
143% of cyber attacks target small businesses despite them representing only 99.9% of all US firms with fewer than 500 employees
Verified2In 2023, small businesses experienced a 424% increase in ransomware attacks compared to 2022, affecting 66% of SMBs surveyed
Verified361% of small and medium-sized businesses reported at least one cyber incident in the past year as of 2024 data
Verified4UK small businesses face 50,000 cyber attacks per month on average, equating to over 600,000 annually per firm size group
Directional576% of small businesses in the US reported a cyber attack attempt in 2023, with phishing being the most common entry point
Single source6Small firms with under 50 employees saw a 300% rise in DDoS attacks from 2021 to 2023
Verified728% of all data breaches in 2023 involved small businesses, up from 22% in 2022
Verified8Australian SMBs reported 2.7 million cyber incidents in 2023, with small businesses comprising 85% of victims
Verified995% of small businesses in a 2024 survey experienced phishing attempts, averaging 20 per month per business
Directional10In Europe, small enterprises faced 1 in 10 chance of cyber attack daily in 2023 ENISA report
Single source1153% of small US retailers were hit by cyber attacks in 2023 holiday season
Verified12SMBs in healthcare sector saw 400% increase in attacks post-2022, with 1,200 incidents reported
Verified1367% of Canadian small businesses encountered ransomware in 2023
Verified14Global SMB cyber attacks rose 15% YoY to 12 billion attempts in 2023
Directional1582% of small businesses without cybersecurity training faced attacks in 2023
Single source16Indian SMBs reported 1.5 million cyber incidents in FY2023, 70% phishing-related
Verified1739% of small manufacturers experienced cyber intrusions in 2023
Verified18SMBs in finance saw 550 attacks per day globally in 2023 average
Verified1971% of small businesses in Latin America faced BEC scams in 2023
Directional20US SMB e-commerce sites hit by 25% more attacks in Q4 2023
Single source2148% of small businesses closed temporarily after cyber attack in 2023 surveys
Verified22African SMBs reported 300% surge in mobile-targeted attacks in 2023
Verified2364% of small logistics firms faced supply chain attacks in 2023
Verified24SMB VoIP systems saw 1,200 attacks per minute globally in 2023 peak
Directional2555% of small education providers hit by cyber attacks in 2023 academic year
Single source26New Zealand SMBs experienced 45,000 attacks monthly average in 2023
Verified2773% of small real estate firms targeted by wire fraud in 2023
Verified28SMB cloud migrations led to 200% attack increase in 2023
Verified2959% of small construction businesses faced ransomware in 2023
DirectionalAttack Frequency and Prevalence Interpretation
While small businesses might feel like David in the digital world, the statistics reveal they’re facing an entire army of Goliaths with increasingly sophisticated slingshots.
Business Impacts
160% of small businesses fail within 6 months of a major cyber attack
Verified251% of SMBs experienced operational downtime exceeding 24 hours post-attack 2023
Verified3Loss of customer trust post-breach affects 75% of SMBs long-term
Verified429% of attacked SMBs laid off staff due to financial strain in 2023
Directional5Supply chain disruptions from SMB breaches impacted 40% partner firms 2023
Single source666% of SMBs halted digital services for weeks after ransomware 2023 Sophos
Verified7Employee morale dropped 45% post-incident in SMB surveys 2023
Verified837% of small retailers lost holiday sales season to DDoS 2023
Verified9Regulatory scrutiny increased compliance costs 30% for breached SMBs
Directional1022% of SMBs pivoted business models after major cyber event 2023
Single source11Data loss led to product recalls costing millions for 12% SMB manufacturers
Verified12Insurance claim denials post-poor security hit 28% SMBs 2023
Verified13Partnership losses averaged 25% for SMBs post-supply chain attack
Verified14Remote work breaches caused 35% higher staff turnover in SMBs 2023
Directional1548% SMBs delayed expansion plans due to cyber recovery 2023
Single source16Brand value erosion estimated at 18% for SMBs after public breach
Verified17Legal battles post-breach consumed 6 months operations for 20% SMBs
Verified1855% of small healthcare SMBs suspended patient services post-attack
Verified19Vendor lock-in increased 40% after breach recovery tools 2023 SMBs
DirectionalBusiness Impacts Interpretation
For a small business, a cyber attack is less a temporary IT problem and more a full-blown business catastrophe that systematically shatters operations, decimates finances, and permanently scars customer trust, often proving fatal.
Common Attack Types
1Phishing comprises 36% of all SMB cyber attacks in 2023 Verizon DBIR update
Verified2Ransomware affected 66% of small businesses via email vectors in 2023 Ponemon study
Verified3DDoS attacks made up 22% of incidents against SMBs in 2023 Cloudflare data
Verified4Business Email Compromise (BEC) scams cost SMBs $2.9 billion in 2023 FBI IC3
Directional5Malware infections via drive-by downloads hit 41% of SMBs in 2023
Single source6Supply chain attacks impacted 15% of small manufacturers in 2023
Verified7Credential stuffing attacks rose 35% against SMBs in 2023 Akamai
Verified829% of SMB breaches from stolen credentials per IBM 2023 report
Verified9Vishing (voice phishing) targeted 52% of SMB call centers in 2023
Directional10IoT device exploits affected 28% of small retail SMBs in 2023
Single source11SQL injection vulnerabilities exploited in 18% of SMB web apps 2023
Verified12Insider threats caused 34% of SMB data leaks in 2023 Verizon
Verified13Cryptojacking incidents up 50% in SMB cloud environments 2023
Verified14Smishing (SMS phishing) hit 47% of small service businesses 2023
Directional15Zero-day exploits used in 12% of advanced SMB attacks 2023
Single source16Fileless malware evaded 60% of SMB antivirus in 2023 tests
Verified17Account takeover via MFA fatigue in 25% SMB finance firms 2023
Verified18Watering hole attacks on SMB industry sites rose 40% 2023
Verified19Rogue Wi-Fi evil twin attacks on 33% traveling SMB owners 2023
DirectionalCommon Attack Types Interpretation
For a small business, the modern cyber threat landscape is a carnival of horrors where a single cleverly worded email can be the main attraction, but the sideshows of ransomware, credential theft, and even rogue coffee shop Wi-Fi are all equally eager to take your money and data.
Financial Costs
1Average cost of cyber attack to small business is $25,000 per incident in 2023
Verified2Ransomware payments by SMBs averaged $1.54 million globally in 2023 Sophos
Verified360% of small businesses suffer $100,000+ losses from BEC scams annually
Verified4Data breach costs SMBs $4.45 million on average per IBM 2023 report adapted for size
Directional5DDoS downtime costs small retailers $9,000 per hour in 2023
Single source643% of SMBs spent over $50,000 on recovery post-attack in 2023
Verified7Phishing leads to $4.9 million average loss for SMBs per campaign
Verified8Insurance premiums for SMB cyber coverage rose 25% to $2,500 avg in 2023
Verified9Lost revenue from cyber incidents averages 22% of annual turnover for SMBs
Directional10Remediation costs for malware hit $200,000 median for small firms 2023
Single source11BEC fraud drained $2.4 billion from 21,000+ SMB victims in 2023 FBI
Verified12Supply chain breach indirect costs to SMBs $1.2 million avg 2023
Verified13Legal fees post-breach average $150,000 for SMBs facing fines 2023
Verified14Notification costs after breach $250 per record for SMBs 2023 Ponemon
Directional15Productivity loss from DDoS $40,000 daily for average SMB 2023
Single source16Ransom negotiation and forensics cost SMBs $75,000 avg 2023
Verified17Customer churn post-attack 20-30% costing $500k lifetime value SMBs
Verified18Hardware replacement post-attack $30,000 median for SMBs 2023
Verified19Fines under GDPR for SMB breaches avg €50,000 in 2023 ENISA
Directional20Reputation damage leads to 15% revenue drop for 6 months post-attack SMBs
Single sourceFinancial Costs Interpretation
The brutal math of modern small business is that while a cyberattack may initially invoice you for a new server, it’s the attached, endless subscription to legal fees, customer loss, and reputation repair that will truly bankrupt your spirit.
Mitigation and Statistics on Protection
1Only 26% of small businesses have cyber insurance coverage in 2024 surveys
Verified2SMBs with MFA enabled reduced account compromise by 99% per Microsoft 2023
Verified3Regular backups helped 58% SMBs recover without paying ransom 2023 Sophos
Verified4Employee training cut phishing success rates by 70% in SMBs 2023 Proofpoint
Directional582% of SMBs lacking EDR tools suffered breaches vs 23% with it 2023
Single source6Patch management reduced exploit success by 85% in SMB networks 2023
Verified7Zero-trust adoption lowered lateral movement in 65% SMB pilots 2023
Verified8AI-driven threat detection blocked 92% attacks pre-breach for SMBs 2023
Verified9Incident response plans enabled 40% faster recovery for prepared SMBs
Directional10Email filtering stopped 97% phishing for SMBs with advanced gateways 2023
Single source11Cloud security posture management cut misconfigs by 75% SMBs 2023
Verified1271% SMBs with segmented networks limited breach scope 2023 Verizon
Verified13Vulnerability scanning quarterly reduced risks 60% for SMBs 2023
Verified14Managed detection services detected 88% threats early for SMBs 2023
Directional15Password managers adoption dropped credential theft 80% SMBs 2023
Single source16Firewall updates prevented 55% DDoS escalations in SMBs 2023
Verified1734% fewer incidents for SMBs using threat intel sharing 2023
Verified18Backup testing success rate 92% correlated to full recovery 2023 Sophos
Verified19SMBs with cyber drills recovered 50% faster post-attack 2023
Directional20Encryption adoption reduced data exposure impact by 70% 2023 IBM
Single source2145% drop in malware infections with endpoint protection suites SMBs 2023
Verified22Vendor risk assessments cut supply chain attacks 62% SMBs 2023
Verified2367% SMBs with SIEM tools identified breaches under 24 hours 2023
Verified24Multi-factor authentication blocked 99.9% automated attacks 2023 Microsoft
Directional25Regular audits found 78% vulnerabilities before exploitation SMBs 2023
Single source2652% reduction in phishing clicks post-awareness campaigns SMBs 2023
Verified27IoT security gateways protected 85% SMB devices from exploits 2023
Verified28DNS filtering stopped 96% malicious domains for SMBs 2023 Cisco
Verified29Business continuity plans saved 65% revenue during outages SMBs 2023
Directional30Collaborative defense with MSPs reduced attack success 73% SMBs 2023
Single sourceMitigation and Statistics on Protection Interpretation
While small businesses view cyber insurance as a silver bullet, the real shield is consistently doing the fundamentals—like enabling MFA, training employees, and patching systems—which the statistics prove dramatically reduce both the likelihood and impact of an attack, making insurance more of a final safety net than a first line of defense.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2PONEMONponemon.orgVisit source
- Reference 3CISAcisa.govVisit source
- Reference 4GOVgov.ukVisit source
- Reference 5NATIONWIDEnationwide.comVisit source
- Reference 6CLOUDFLAREcloudflare.comVisit source
- Reference 7IBMibm.comVisit source
- Reference 8ACSCacsc.gov.auVisit source
- Reference 9BARRACUDAbarracuda.comVisit source
- Reference 10ENISAenisa.europa.euVisit source
- Reference 11RETAILDIVEretaildive.comVisit source
- Reference 12HHShhs.govVisit source
- Reference 13CYBERcyber.gc.caVisit source
- Reference 14AKAMAIakamai.comVisit source
- Reference 15SBAsba.govVisit source
- Reference 16CERT-INcert-in.org.inVisit source
- Reference 17NAMnam.orgVisit source
- Reference 18FIREEYEfireeye.comVisit source
- Reference 19INTERPOLinterpol.intVisit source
- Reference 20SHOPIFYshopify.comVisit source
- Reference 21CHAMBEROFCOMMERCEchamberofcommerce.orgVisit source
- Reference 22ITUitu.intVisit source
- Reference 23LOGISTICSMGMTlogisticsmgmt.comVisit source
- Reference 242600HZ2600hz.comVisit source
- Reference 25EDTECHMAGAZINEedtechmagazine.comVisit source
- Reference 26CERTcert.govt.nzVisit source
- Reference 27NARnar.realtorVisit source
- Reference 28MICROSOFTmicrosoft.comVisit source
- Reference 29AGCagc.orgVisit source
- Reference 30IC3ic3.govVisit source
- Reference 31MALWAREBYTESmalwarebytes.comVisit source
- Reference 32NISTnist.govVisit source
- Reference 33PROOFPOINTproofpoint.comVisit source
- Reference 34IOACTIVEioactive.comVisit source
- Reference 35ACUNETIXacunetix.comVisit source
- Reference 36CROWDSTRIKEcrowdstrike.comVisit source
- Reference 37LOOKOUTlookout.comVisit source
- Reference 38MANDIANTmandiant.comVisit source
- Reference 39AV-TESTav-test.orgVisit source
- Reference 40ZSCALERzscaler.comVisit source
- Reference 41CISCOcisco.comVisit source
- Reference 42SOPHOSsophos.comVisit source
- Reference 43THEHARTFORDthehartford.comVisit source
- Reference 44HBRhbr.orgVisit source
- Reference 45SALESFORCEsalesforce.comVisit source
- Reference 46GARTNERgartner.comVisit source
- Reference 47DARKTRACEdarktrace.comVisit source
- Reference 481PASSWORD1password.comVisit source
- Reference 49ISACisac.orgVisit source
- Reference 50SPLUNKsplunk.comVisit source
- Reference 51QUALYSqualys.comVisit source
- Reference 52KNOWBE4knowbe4.comVisit source
- Reference 53DATTOdatto.comVisit source
- Reference 54COMPUMATICAcompumatica.comVisit source