Small businesses report being cyber-attack targets, with 43% saying they have already been attacked. Breach activity is also shaped by criminal threat actors and credential abuse, since 71% of breaches in the 2024 Verizon DBIR involved criminal threat actors and 60% relied on stolen credentials or phishing. For many teams, the impact does not end at the initial incident.
Key Takeaways
- 43% of small businesses said they have been the target of cyber attacks
- 71% of all breaches in the 2024 Verizon DBIR involved criminal threat actors
- 60% of breaches used stolen credentials or credentials obtained through phishing
- 1 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023
- $4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)
- $1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)
- In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 days
- In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)
- In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)
Nearly half of small businesses face cyber attacks, and breaches often start with human error and stolen credentials.
Related reading
01 · Category
Industry Trends20 stats
01
43% of small businesses said they have been the target of cyber attacks
02
71% of all breaches in the 2024 Verizon DBIR involved criminal threat actors
03
60% of breaches used stolen credentials or credentials obtained through phishing
04
68% of breaches involved the use of malware
05
61% of breaches were motivated by financial gain
06
64% of breaches involved the human element (phishing, social engineering, or misuse of credentials)
07
55% of organizations reported a breach involved ransomware
08
19% of breaches involved web applications
09
30% of breaches involved privilege escalation
10
49% of breaches involved the use of phishing
11
45% of breaches used malware to deliver payloads
12
30% of breaches involved stolen passwords
13
24% of breaches involved cloud infrastructure
14
60% of breaches involve the human element according to Verizon DBIR
15
45% of breaches involve misuse of credentials
16
34% of breaches involve hacking and exploitation for initial access
17
24% of breaches involve denial of service
18
21% of small businesses experienced unauthorized access to email accounts
19
40% of cyber attacks target small businesses
20
28% of victims of breaches are small businesses per IBM data
Interpretation
Industry Trends Interpretation
With 71% of 2024 breaches driven by criminal threat actors and 60% of breaches relying on malware or the human element, the data shows that small businesses face a particularly high risk of financially motivated, credential and phishing centered attacks, with 43% reporting they have already been targeted.
02 · Category
Cost Analysis23 stats
01
1 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023
02
$4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)
03
$1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)
04
$5.90 million is the average total cost of a data breach for organizations with 500,000+ records exposed (IBM 2023)
05
$3.86 million is the average total cost of a data breach for industries experiencing high compliance complexity (IBM 2023)
06
279 days is the median time to identify and 75 days to contain in IBM Cost of a Data Breach 2022
07
10.84% is the average security incident cost variance from initial estimates (IBM 2022/2023 analysis context)
08
29% of breach costs were due to incident response and remediation (IBM 2023 Cost of a Data Breach)
09
23% of breach costs were due to detection and escalation (IBM 2023 Cost of a Data Breach)
10
24% of breach costs were due to lost business (IBM 2023 Cost of a Data Breach)
11
17% of breach costs were due to notifying/regulatory (IBM 2023 Cost of a Data Breach)
12
19% of breach costs were due to customer turnover (IBM 2023 Cost of a Data Breach)
13
$5.01 million average breach cost for organizations with 50,000-100,000 records exposed (IBM Cost of a Data Breach 2023)
14
$3.31 million average breach cost for organizations with 10,000-25,000 records exposed (IBM 2023)
15
$2.62 million average breach cost for organizations with 100,000-500,000 records exposed (IBM 2023)
16
$1.90 million average breach cost for organizations with 1,000-10,000 records exposed (IBM 2023)
17
Median cost of a data breach in 2023 was $3.38 million (IBM 2023)
18
$136per record is the average cost per compromised record in 2023 (IBM 2023)
19
$24,000average cost of incident response per breach (IBM 2023 component estimate)
20
30% of breach costs come from business disruption (IBM 2023)
21
$5.2 billion global cybercrime damage to organizations was projected for 2020 (McAfee/IMF-style estimates; industry projection used in reports)
22
$75,000average cost to recover from ransomware incident for small businesses (industry estimate)
23
Median business disruption time after a data breach was 8 weeks (Ponemon/IBM data sharing)
Interpretation
Cost Analysis Interpretation
Across these IBM and related estimates, the biggest warning sign is that breach impacts can linger for weeks to months, with 1 in 10 organizations facing operational disruption for more than 1 month and incident costs rising quickly to a 2023 global average of $4.45 million.
More related reading
03 · Category
Performance Metrics20 stats
01
In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 days
02
In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)
03
In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)
04
In IBM Cost of a Data Breach 2023, 59% of breaches involved internal detection
05
In IBM Cost of a Data Breach 2023, 38% of breaches took over 200 days to identify
06
In IBM Cost of a Data Breach 2023, 27% took over 1,000 days to contain
07
In MS-ISAC reporting, average time between vulnerability disclosure and adoption varied; mean patching window was 60-90 days (MS-ISAC guidance references)
08
CISA KEV catalog includes vulnerabilities actively exploited with a requirement to patch within 21 days (CISA Binding Operational Directive timeline)
09
CISA requires federal agencies to remediate KEVs within 21 days once added (BOD 22-01)
10
Stop ransomware guidance recommends backups be tested every 3 months (CISA best practice cadence)
11
CISA recommends that incident responders test restore from backups at least annually (CISA guidance)
12
In Verizon DBIR, 30% of breaches used web application attacks leading to data theft within days (DBIR operational timing summary)
13
In IBM Cost of a Data Breach, 12% of breaches were detected by law enforcement or others rather than internal systems
14
In IBM Cost of a Data Breach, 25% of breaches had detection time under 1 day
15
In IBM Cost of a Data Breach, 31% of breaches had containment time under 1 day
16
Emsisoft reported median ransomware encryption speed of ~1 minute per file in typical cases (industry analysis)
17
CISA recommends requiring MFA for remote access to reduce credential theft risk (metric is adoption as performance enhancer; used in KPIs)
18
CISA suggests implementing application allow-listing to reduce malware execution opportunities
19
NIST SP 800-53 controls are designed for measurable security performance; baseline includes 4,000+ controls (control count enabling metric KPIs)
20
NIST SP 800-30 provides a risk assessment methodology with 6 steps (repeatable metrics workflow)
Interpretation
Performance Metrics Interpretation
Across major studies, small-business breaches are often detected far too late, with detection taking a median of 2 days in Verizon but averaging 207 days in IBM and 38% of cases taking over 200 days to identify, underscoring how long dwell time remains a critical problem.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Small Business Cyber Attack Statistics. Gitnux. https://gitnux.org/small-business-cyber-attack-statistics
MLA
Marcus Afolabi. "Small Business Cyber Attack Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cyber-attack-statistics.
Chicago
Marcus Afolabi. 2026. "Small Business Cyber Attack Statistics." Gitnux. https://gitnux.org/small-business-cyber-attack-statistics.
Sources & references
17 datasets cited across this report · attribution is report-level
+9 additional datasets cited (not shown individually)