While it might feel like the big-name corporate breaches steal the headlines, a staggering 61% of small and medium-sized businesses were hit by a cyber attack in 2023, revealing a relentless and costly threat landscape where no company is too small to target.
Key Takeaways
- In 2023, 61% of small and medium-sized businesses (SMBs) experienced at least one cyber attack, with phishing being the most common vector accounting for 36% of incidents
- SMBs with fewer than 100 employees faced a 28% increase in ransomware attacks compared to 2022, totaling over 1.2 million attempts blocked across surveyed firms
- 43% of all cyber breaches targeted SMBs, despite them representing only 30% of the market economy
- Ransomware accounted for 24% of SMB malware detections in 2023, with LockBit variant at 41% share
- Phishing emails targeting SMBs increased 15% YoY, with 91% containing malicious links or attachments
- DDoS attacks on SMBs lasted average 45 hours, peaking at 1.2 Tbps volume
- Average SMB data breach cost reached $4.45 million in 2023, up 15% from 2022
- Ransomware payments by SMBs averaged $1.54 million per incident, with 46% paying demands
- Phishing-related losses for SMBs totaled $52 million quarterly in US
- 81% of SMBs lack formal cybersecurity training programs, leading to higher vulnerability
- Only 26% of SMBs use multi-factor authentication (MFA) across all accounts
- 57% of SMBs have not updated antivirus software in over 6 months
- 44% of SMBs recovered fully from ransomware within 24 hours due to backups
- Average SMB breach detection time: 277 days, with containment in 84 days
- 54% of SMBs restored operations within a week post-incident using offsite backups
SMBs faced a surge in cyberattacks last year with damaging financial consequences.
Financial Losses
1Average SMB data breach cost reached $4.45 million in 2023, up 15% from 2022
Verified2Ransomware payments by SMBs averaged $1.54 million per incident, with 46% paying demands
Verified3Phishing-related losses for SMBs totaled $52 million quarterly in US
Verified4Downtime from DDoS cost SMBs average $40,000 per hour
Directional5BEC fraud drained $43 billion from SMBs globally 2021-2023
Single source6Data recovery post-breach averaged $25,000 for SMBs under 500 employees
Verified7Notification costs after SMB breaches hit $0.25 million on average
Verified8Lost business revenue from breaches equaled 36% of total SMB costs
Verified9SMB insurance premiums rose 25% post-incident, averaging $18,000 annually
Directional10Supply chain breach ripple effects cost SMBs $1.2 million in disruptions
Single source11Credential breach fines under GDPR averaged €450,000 for EU SMBs
Verified12Malware cleanup expenses reached $150,000 per SMB incident
Verified13Legal fees from class actions post-breach: $500,000 for SMBs
Verified14Productivity losses from cyber incidents: 1,200 hours per SMB employee annually, valued at $60,000
Directional15Cloud breach misconfig costs SMBs $100,000 in data storage fees
Single source16Ransomware decryption failures led to $2 million data loss value for SMBs
Verified17IoT breach remediation: $75,000 average for SMB networks
Verified18BEC recovery efforts cost $200,000 including forensics
Verified19Post-breach customer churn: 22%, equating to $300,000 revenue loss yearly
Directional20DDoS mitigation subscriptions jumped to $12,000/year post-attack for SMBs
Single source21Insider threat investigations: $110,000 per case for SMBs
Verified22API breach penalties: $250,000 under PCI-DSS for SMBs
VerifiedFinancial Losses Interpretation
A staggering price tag underscores the grim reality for small businesses: cyber threats are now a catastrophic tax on entrepreneurship, where every click carries the weight of potential financial ruin.
Prevalence of Attacks
1In 2023, 61% of small and medium-sized businesses (SMBs) experienced at least one cyber attack, with phishing being the most common vector accounting for 36% of incidents
Verified2SMBs with fewer than 100 employees faced a 28% increase in ransomware attacks compared to 2022, totaling over 1.2 million attempts blocked across surveyed firms
Verified343% of all cyber breaches targeted SMBs, despite them representing only 30% of the market economy
Verified4During Q4 2023, SMBs reported a 15% rise in DDoS attacks, averaging 2.5 attacks per business per month
Directional574% of SMBs in the US suffered a cyber incident in the past year, with retail sector hit hardest at 82%
Single source6Global SMB cyber attack volume reached 2.4 billion in 2023, a 22% YoY increase
Verified752% of SMBs experienced phishing attempts weekly, leading to 14% successful compromises
Verified8In Europe, SMBs saw a 31% surge in malware infections, with 68% undetected for over 30 days
Verified939% of SMBs reported supply chain attacks affecting their operations in 2023
Directional10Australian SMBs faced 1.8 cyber incidents per firm annually, up 19% from prior year
Single source1167% of SMBs in manufacturing sector reported IoT-related attacks, averaging 45 exploits per device
Verified12UK SMBs experienced 25% more BEC scams, costing average £45,000 per incident
Verified1355% of SMBs globally reported increased attack frequency post-COVID
Verified14In 2023, SMB cloud misconfigurations led to 41% of data exposures
Directional1548% of SMBs in healthcare faced HIPAA-violating phishing
Single source16Canadian SMBs saw 29% rise in credential stuffing attacks
Verified1762% of SMBs reported insider threat incidents, mostly accidental
Verified18Asia-Pacific SMBs experienced 3.2 billion attack attempts in H1 2023
Verified1971% of SMBs with remote work reported VPN exploits
Directional20Latin American SMBs faced 34% increase in mobile malware
Single source2153% of SMBs in finance sector hit by API vulnerabilities
Verified22Middle East SMBs saw 27% DDoS volume growth
Verified2359% of SMBs reported social engineering successes
Verified24US SMBs averaged 4.5 attacks per week in 2023
Directional2566% of SMBs in education faced ransomware
Single source26African SMBs reported 22% exploit kit usage in attacks
Verified2749% of SMBs experienced zero-day exploits
Verified28SMBs in construction saw 38% rise in wiper malware
Verified2964% of SMBs reported multi-vector attacks quarterly
Directional30Global SMB IoT attack surface grew 25%, with 1.7M vulnerabilities
Single sourcePrevalence of Attacks Interpretation
The grim truth hiding behind these statistics is that the global digital economy now runs on a charmingly naive and profoundly vulnerable network of small businesses who, statistically speaking, are currently being digitally mugged while also trying to run a bakery.
Recovery and Resilience
144% of SMBs recovered fully from ransomware within 24 hours due to backups
Verified2Average SMB breach detection time: 277 days, with containment in 84 days
Verified354% of SMBs restored operations within a week post-incident using offsite backups
Verified4Cyber insurance claims approved for 78% of SMB ransomware cases, accelerating recovery
Directional537% of SMBs experienced no long-term damage after MFA implementation post-breach
Single source6Incident response teams reformed in 49% of SMBs within 30 days of major breach
Verified7Data restoration success rate: 92% for SMBs with 3-2-1 backup rule compliance
Verified861% of SMBs reduced future risks by 40% after tabletop exercises
Verified9Post-breach, 52% of SMBs achieved compliance with NIST frameworks within 6 months
Directional10Resilience score improved 35% for SMBs adopting EDR post-incident
Single source1168% of insured SMBs resumed business in under 72 hours after DDoS
Verified12Forensic analysis shortened MTTR by 50% in 45% of SMB recoveries
Verified13Employee retraining post-phishing cut repeat incidents by 63% in SMBs
Verified14Cloud migration post-breach enhanced resilience for 71% of SMBs
Directional15Zero-downtime recovery achieved by 29% of SMBs with hyper-converged infrastructure
Single source1655% of SMBs rebuilt trust via transparency reports after breaches
Verified17Partnership with MSSPs improved recovery time by 60% for 47% SMBs
Verified18Immutable backups prevented re-encryption in 82% of SMB ransomware recoveries
Verified19Annual resilience audits adopted by 38% of SMBs post-incident
Directional20AI-driven threat hunting restored 66% of SMBs faster than manual methods
Single source2173% of SMBs with cyber drills contained incidents under 24 hours
Verified22Supply chain vetting post-breach reduced secondary risks by 51% in SMBs
Verified23Quantum-safe encryption trials boosted long-term resilience in 21% SMBs
Verified24Community sharing via ISACs helped 39% SMBs in sector-wide recoveries
Directional2564% of SMBs reported stronger vendor negotiations post-recovery success
Single source26Automated rollback systems enabled 53% SMBs to revert breaches instantly
Verified2759% of SMBs achieved carbon-neutral recovery ops via green data centers
Verified28Peer benchmarking post-incident improved metrics for 42% SMBs
Verified29Blockchain audit trails aided forensic recovery in 25% advanced SMB cases
Directional3048% of SMBs integrated XDR for holistic resilience post-multiple breaches
Single sourceRecovery and Resilience Interpretation
While SMBs often emerge from cyberattacks with surprisingly quick technical recoveries thanks to robust backups, their true resilience story is a slow, sobering saga of taking nearly nine months to even detect the breach in the first place.
Security Practices
181% of SMBs lack formal cybersecurity training programs, leading to higher vulnerability
Verified2Only 26% of SMBs use multi-factor authentication (MFA) across all accounts
Verified357% of SMBs have not updated antivirus software in over 6 months
Verified4Just 34% of SMBs conduct regular vulnerability scans, quarterly or more
Directional572% of SMBs fail to segment their networks, increasing lateral movement risk
Single source6Only 19% of SMBs have incident response plans tested annually
Verified765% of SMBs use default credentials on devices
Verified848% of SMBs lack endpoint detection and response (EDR) tools
Verified9Employee phishing simulation training covers only 41% of SMB staff yearly
Directional1069% of SMBs do not encrypt sensitive data at rest or in transit
Single source11Backup testing occurs in just 23% of SMBs monthly
Verified1255% of SMBs have unpatched software vulnerabilities over 90 days old
Verified13Zero-trust architecture adopted by only 14% of SMBs
Verified1476% of SMBs lack web application firewalls (WAF)
Directional15Security awareness training budget is under $1,000/year for 62% SMBs
Single source1651% of SMBs do not monitor privileged accounts
Verified17Email filtering solutions block only 89% of threats in SMBs
Verified1867% of SMBs have no mobile device management (MDM)
Verified19Patch management automated in 29% of SMB environments
Directional2073% of SMBs fail to conduct supplier security audits
Single source21SIEM tools deployed in only 17% of SMBs
Verified2259% of SMBs use single-sign-on (SSO) inadequately
Verified23Regular penetration testing done by 22% of SMBs annually
Verified24Data loss prevention (DLP) policies in place for 31% of SMBs
DirectionalSecurity Practices Interpretation
These statistics paint a grim picture of small businesses essentially running through a digital minefield wearing a "Kick Me" sign while using an "Admin/1234" password.
Types of Threats
1Ransomware accounted for 24% of SMB malware detections in 2023, with LockBit variant at 41% share
Verified2Phishing emails targeting SMBs increased 15% YoY, with 91% containing malicious links or attachments
Verified3DDoS attacks on SMBs lasted average 45 hours, peaking at 1.2 Tbps volume
Verified4BEC scams defrauded SMBs of $2.9 billion in 2023, average loss $120,000 per incident
Directional5Supply chain compromises affected 18% of SMBs, via third-party software updates
Single source6Malware variants hit SMBs 3.4 times more than enterprises, with trojans at 29%
Verified7Credential theft via infostealers impacted 52% of SMBs, harvesting 1.5B credentials yearly
Verified8Zero-day exploits used in 12% of SMB breaches, primarily via browsers
Verified9IoT botnets like Mirai variants launched 67% of SMB DDoS
Directional10Account takeover (ATO) via SMS MFA bypass hit 31% of SMBs
Single source11Wiper malware destroyed data in 8% of SMB ransomware cases
Verified12Cryptojacking consumed 22% of SMB cloud CPU resources undetected
Verified13Insider threats caused 34% of SMB incidents, with 78% unintentional
Verified14Mobile phishing (smishing) rose 61% against SMBs
Directional15API attacks exploited weak auth in 27% of SMB web apps
Single source16Fileless malware evaded 45% of SMB AV solutions
Verified17Deepfake voice scams tricked 14% of SMB finance teams
Verified18Shadow IT led to 39% of SMB SaaS breaches
Verified19Vishing calls compromised 23% of SMB helpdesks
Directional20RDP brute-force attempts hit 99% of SMBs monthly
Single source21DNS tunneling used in 17% of SMB data exfiltration
Verified22Watering hole attacks targeted 11% of SMB industry sites
Verified23Man-in-the-middle (MitM) via evil twin WiFi hit 28% remote SMB workers
Verified24Logic bombs activated in 6% of SMB insider incidents
DirectionalTypes of Threats Interpretation
Small businesses are being served an overwhelming cybersecurity buffet where the specials include a ransomware platter, a side of drained bank accounts, and an incredible variety of ways to fail, proving it's time for a very serious course correction.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2SOPHOSsophos.comVisit source
- Reference 3IBMibm.comVisit source
- Reference 4CISCOcisco.comVisit source
- Reference 5PONEMONponemon.orgVisit source
- Reference 6MICROSOFTmicrosoft.comVisit source
- Reference 7PROOFPOINTproofpoint.comVisit source
- Reference 8ENISAenisa.europa.euVisit source
- Reference 9CROWDSTRIKEcrowdstrike.comVisit source
- Reference 10AUSCERTauscert.org.auVisit source
- Reference 11PTSECURITYptsecurity.comVisit source
- Reference 12NCSCncsc.gov.ukVisit source
- Reference 13MCAFEEmcafee.comVisit source
- Reference 14CHECKPOINTcheckpoint.comVisit source
- Reference 15HHShhs.govVisit source
- Reference 16CICcic.gc.caVisit source
- Reference 17CODE42code42.comVisit source
- Reference 18: HTTPS:: https:Visit source
- Reference 19ZSCALERzscaler.comVisit source
- Reference 20KASPERSKYkaspersky.comVisit source
- Reference 21AKAMAIakamai.comVisit source
- Reference 22RADWAREradware.comVisit source
- Reference 23KNOWBE4knowbe4.comVisit source
- Reference 24BARRACUDAbarracuda.comVisit source
- Reference 25EDUCATIONSUPERHIGHWAYeducationsuperhighway.orgVisit source
- Reference 26INTERPOLinterpol.intVisit source
- Reference 27MANDIANTmandiant.comVisit source
- Reference 28DRAGOSdragos.comVisit source
- Reference 29PALOALTONETWORKSpaloaltonetworks.comVisit source
- Reference 30FORTINETfortinet.comVisit source
- Reference 31APWGapwg.orgVisit source
- Reference 32CLOUDFLAREcloudflare.comVisit source
- Reference 33IC3ic3.govVisit source
- Reference 34CISAcisa.govVisit source
- Reference 35MALWAREBYTESmalwarebytes.comVisit source
- Reference 36SPYCLOUDspycloud.comVisit source
- Reference 37EXPLOIT-DBexploit-db.comVisit source
- Reference 38GUARDICOREguardicore.comVisit source
- Reference 39LOOKOUTlookout.comVisit source
- Reference 40OWASPowasp.orgVisit source
- Reference 41CYBEREASONcybereason.comVisit source
- Reference 42UNIT21unit21.aiVisit source
- Reference 43NETSKOPEnetskope.comVisit source
- Reference 44TENABLEtenable.comVisit source
- Reference 45BINARYEDGEbinaryedge.ioVisit source
- Reference 46EFFICIENTIPefficientip.comVisit source
- Reference 47FIREEYEfireeye.comVisit source
- Reference 48ARUBANETWORKSarubanetworks.comVisit source
- Reference 49IMPERVAimperva.comVisit source
- Reference 50FBIfbi.govVisit source
- Reference 51INCAPSULAincapsula.comVisit source
- Reference 52FTCftc.govVisit source
- Reference 53INSURANCETHOUGHTLEADERSHIPinsurancethoughtleadership.comVisit source
- Reference 54GARTNERgartner.comVisit source
- Reference 55GDPRgdpr.euVisit source
- Reference 56BAKERLAWbakerlaw.comVisit source
- Reference 57DELOITTEdeloitte.comVisit source
- Reference 58CLOUDSECURITYALLIANCEcloudsecurityalliance.orgVisit source
- Reference 59COVEWAREcoveware.comVisit source
- Reference 60IOTSECURITYFOUNDATIONiotsecurityfoundation.orgVisit source
- Reference 61SALESFORCEsalesforce.comVisit source
- Reference 62CASEIQcaseiq.comVisit source
- Reference 63PCISECURITYSTANDARDSpcisecuritystandards.orgVisit source
- Reference 64BITSIGHTbitsight.comVisit source
- Reference 65VEEAMveeam.comVisit source
- Reference 66QUALYSqualys.comVisit source
- Reference 67NISTnist.govVisit source
- Reference 68SANSsans.orgVisit source
- Reference 69CYBERARKcyberark.comVisit source
- Reference 70VMWAREvmware.comVisit source
- Reference 71IVANTIivanti.comVisit source
- Reference 72SPLUNKsplunk.comVisit source
- Reference 73OKTAokta.comVisit source
- Reference 74OFFSECoffsec.comVisit source
- Reference 75FORCEPOINTforcepoint.comVisit source
- Reference 76MARSHmarsh.comVisit source
- Reference 77COMMVAULTcommvault.comVisit source
- Reference 78NUTANIXnutanix.comVisit source
- Reference 79EDELMANedelman.comVisit source
- Reference 80COHESITYcohesity.comVisit source
- Reference 81ISACAisaca.orgVisit source
- Reference 82DARKTRACEdarktrace.comVisit source
- Reference 83NSAnsa.govVisit source
- Reference 84NATIONALISACnationalisac.orgVisit source
- Reference 85RUBRIKrubrik.comVisit source