Small businesses report being cyber-attack targets, with 43% saying they have already been attacked. Breach activity is also shaped by criminal threat actors and credential abuse, since 71% of breaches in the 2024 Verizon DBIR involved criminal threat actors and 60% relied on stolen credentials or phishing. For many teams, the impact does not end at the initial incident.
Key Takeaways
- 43% of small businesses said they have been the target of cyber attacks
- 71% of all breaches in the 2024 Verizon DBIR involved criminal threat actors
- 60% of breaches used stolen credentials or credentials obtained through phishing
- 1 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023
- $4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)
- $1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)
- In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 days
- In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)
- In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)
Nearly half of small businesses face cyber attacks, and breaches often start with human error and stolen credentials.
Related reading
01 · Category
Industry Trends20 stats
01
43% of small businesses said they have been the target of cyber attackshttps://www.verizon.com/business/resources/reports/dbir/
02
71% of all breaches in the 2024 Verizon DBIR involved criminal threat actorshttps://www.verizon.com/business/resources/reports/dbir/
03
60% of breaches used stolen credentials or credentials obtained through phishinghttps://www.verizon.com/business/resources/reports/dbir/
04
68% of breaches involved the use of malwarehttps://www.verizon.com/business/resources/reports/dbir/
05
61% of breaches were motivated by financial gainhttps://www.verizon.com/business/resources/reports/dbir/
06
64% of breaches involved the human element (phishing, social engineering, or misuse of credentials)https://www.verizon.com/business/resources/reports/dbir/
07
55% of organizations reported a breach involved ransomwarehttps://www.verizon.com/business/resources/reports/dbir/
08
19% of breaches involved web applicationshttps://www.verizon.com/business/resources/reports/dbir/
09
30% of breaches involved privilege escalationhttps://www.verizon.com/business/resources/reports/dbir/
10
49% of breaches involved the use of phishinghttps://www.verizon.com/business/resources/reports/dbir/
11
45% of breaches used malware to deliver payloadshttps://www.verizon.com/business/resources/reports/dbir/
12
30% of breaches involved stolen passwordshttps://www.verizon.com/business/resources/reports/dbir/
13
24% of breaches involved cloud infrastructurehttps://www.verizon.com/business/resources/reports/dbir/
14
60% of breaches involve the human element according to Verizon DBIRhttps://www.verizon.com/business/resources/reports/dbir/
15
45% of breaches involve misuse of credentialshttps://www.verizon.com/business/resources/reports/dbir/
16
34% of breaches involve hacking and exploitation for initial accesshttps://www.verizon.com/business/resources/reports/dbir/
17
24% of breaches involve denial of servicehttps://www.verizon.com/business/resources/reports/dbir/
18
21% of small businesses experienced unauthorized access to email accountshttps://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
19
40% of cyber attacks target small businesseshttps://www.cisa.gov/news-events/news/2024/09/20/cisa-urges-small-businesses-improve-cybersecurity
20
28% of victims of breaches are small businesses per IBM datahttps://www.ibm.com/security/digital-assets/dam/ibm-software/graphic/impact-of-cybercrime-on-businesses.pdf
Interpretation
Industry Trends Interpretation
With 71% of 2024 breaches driven by criminal threat actors and 60% of breaches relying on malware or the human element, the data shows that small businesses face a particularly high risk of financially motivated, credential and phishing centered attacks, with 43% reporting they have already been targeted.
02 · Category
Cost Analysis23 stats
01
1 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023https://www.ibm.com/reports/data-breach
02
$4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)https://www.ibm.com/reports/data-breach
03
$1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)https://www.ibm.com/reports/data-breach
04
$5.90 million is the average total cost of a data breach for organizations with 500,000+ records exposed (IBM 2023)https://www.ibm.com/reports/data-breach
05
$3.86 million is the average total cost of a data breach for industries experiencing high compliance complexity (IBM 2023)https://www.ibm.com/reports/data-breach
06
279 days is the median time to identify and 75 days to contain in IBM Cost of a Data Breach 2022https://www.ibm.com/reports/data-breach
07
10.84% is the average security incident cost variance from initial estimates (IBM 2022/2023 analysis context)https://www.ibm.com/reports/data-breach
08
29% of breach costs were due to incident response and remediation (IBM 2023 Cost of a Data Breach)https://www.ibm.com/reports/data-breach
09
23% of breach costs were due to detection and escalation (IBM 2023 Cost of a Data Breach)https://www.ibm.com/reports/data-breach
10
24% of breach costs were due to lost business (IBM 2023 Cost of a Data Breach)https://www.ibm.com/reports/data-breach
11
17% of breach costs were due to notifying/regulatory (IBM 2023 Cost of a Data Breach)https://www.ibm.com/reports/data-breach
12
19% of breach costs were due to customer turnover (IBM 2023 Cost of a Data Breach)https://www.ibm.com/reports/data-breach
13
$5.01 million average breach cost for organizations with 50,000-100,000 records exposed (IBM Cost of a Data Breach 2023)https://www.ibm.com/reports/data-breach
14
$3.31 million average breach cost for organizations with 10,000-25,000 records exposed (IBM 2023)https://www.ibm.com/reports/data-breach
15
$2.62 million average breach cost for organizations with 100,000-500,000 records exposed (IBM 2023)https://www.ibm.com/reports/data-breach
16
$1.90 million average breach cost for organizations with 1,000-10,000 records exposed (IBM 2023)https://www.ibm.com/reports/data-breach
17
Median cost of a data breach in 2023 was $3.38 million (IBM 2023)https://www.ibm.com/reports/data-breach
18
$136per record is the average cost per compromised record in 2023 (IBM 2023)https://www.ibm.com/reports/data-breach
19
$24,000average cost of incident response per breach (IBM 2023 component estimate)https://www.ibm.com/reports/data-breach
20
30% of breach costs come from business disruption (IBM 2023)https://www.ibm.com/reports/data-breach
21
$5.2 billion global cybercrime damage to organizations was projected for 2020 (McAfee/IMF-style estimates; industry projection used in reports)https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/resources/cybercrime-report.html
22
$75,000average cost to recover from ransomware incident for small businesses (industry estimate)https://www.mygovwatch.com/blog/ransomware-impacts-on-small-businesses/
23
Median business disruption time after a data breach was 8 weeks (Ponemon/IBM data sharing)https://www.ibm.com/reports/data-breach
Interpretation
Cost Analysis Interpretation
Across these IBM and related estimates, the biggest warning sign is that breach impacts can linger for weeks to months, with 1 in 10 organizations facing operational disruption for more than 1 month and incident costs rising quickly to a 2023 global average of $4.45 million.
More related reading
03 · Category
Performance Metrics20 stats
01
In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 dayshttps://www.verizon.com/business/resources/reports/dbir/
02
In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)https://www.ibm.com/reports/data-breach
03
In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)https://www.ibm.com/reports/data-breach
04
In IBM Cost of a Data Breach 2023, 59% of breaches involved internal detectionhttps://www.ibm.com/reports/data-breach
05
In IBM Cost of a Data Breach 2023, 38% of breaches took over 200 days to identifyhttps://www.ibm.com/reports/data-breach
06
In IBM Cost of a Data Breach 2023, 27% took over 1,000 days to containhttps://www.ibm.com/reports/data-breach
07
In MS-ISAC reporting, average time between vulnerability disclosure and adoption varied; mean patching window was 60-90 days (MS-ISAC guidance references)https://www.cisa.gov/resources-tools/resources/known-exploited-vulnerabilities
08
CISA KEV catalog includes vulnerabilities actively exploited with a requirement to patch within 21 days (CISA Binding Operational Directive timeline)https://www.cisa.gov/known-exploited-vulnerabilities
09
CISA requires federal agencies to remediate KEVs within 21 days once added (BOD 22-01)https://www.cisa.gov/news-events/alerts/binding-operational-directive-22-01
10
Stop ransomware guidance recommends backups be tested every 3 months (CISA best practice cadence)https://www.cisa.gov/news-events/alerts/alert-cisa-urges-organizations-to-prepare-against-ransomware-and-other-cyber-threats
11
CISA recommends that incident responders test restore from backups at least annually (CISA guidance)https://www.cisa.gov/resources-tools/resources/preventing-ransomware-attacks-using-best-practices
12
In Verizon DBIR, 30% of breaches used web application attacks leading to data theft within days (DBIR operational timing summary)https://www.verizon.com/business/resources/reports/dbir/
13
In IBM Cost of a Data Breach, 12% of breaches were detected by law enforcement or others rather than internal systemshttps://www.ibm.com/reports/data-breach
14
In IBM Cost of a Data Breach, 25% of breaches had detection time under 1 dayhttps://www.ibm.com/reports/data-breach
15
In IBM Cost of a Data Breach, 31% of breaches had containment time under 1 dayhttps://www.ibm.com/reports/data-breach
16
Emsisoft reported median ransomware encryption speed of ~1 minute per file in typical cases (industry analysis)https://www.emsisoft.com/en/blog/23022/ransomware-what-it-does-and-how-to-stop-it/
17
CISA recommends requiring MFA for remote access to reduce credential theft risk (metric is adoption as performance enhancer; used in KPIs)https://www.cisa.gov/news-events/news/2022/05/09/cisa-releases-multi-factor-authentication-guidance
18
CISA suggests implementing application allow-listing to reduce malware execution opportunitieshttps://www.cisa.gov/resources-tools/resources/applications-allowlisting-security-guidance
19
NIST SP 800-53 controls are designed for measurable security performance; baseline includes 4,000+ controls (control count enabling metric KPIs)https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
20
NIST SP 800-30 provides a risk assessment methodology with 6 steps (repeatable metrics workflow)https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Interpretation
Performance Metrics Interpretation
Across major studies, small-business breaches are often detected far too late, with detection taking a median of 2 days in Verizon but averaging 207 days in IBM and 38% of cases taking over 200 days to identify, underscoring how long dwell time remains a critical problem.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Small Business Cyber Attack Statistics. Gitnux. https://gitnux.org/small-business-cyber-attack-statistics
MLA
Marcus Afolabi. "Small Business Cyber Attack Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cyber-attack-statistics.
Chicago
Marcus Afolabi. 2026. "Small Business Cyber Attack Statistics." Gitnux. https://gitnux.org/small-business-cyber-attack-statistics.
Sources & references
17 datasets cited across this report
+9 additional datasets cited (not shown individually)