The average cost of a data breach for an SMB reached $4.45 million last year. Phishing remains the most common attack vector, but ransomware payments alone averaged $1.54 million per incident.
Key Takeaways
- Average SMB data breach cost reached $4.45 million in 2023, up 15% from 2022
- Ransomware payments by SMBs averaged $1.54 million per incident, with 46% paying demands
- Phishing-related losses for SMBs totaled $52 million quarterly in US
- In 2023, 61% of small and medium-sized businesses (SMBs) experienced at least one cyber attack, with phishing being the most common vector accounting for 36% of incidents
- SMBs with fewer than 100 employees faced a 28% increase in ransomware attacks compared to 2022, totaling over 1.2 million attempts blocked across surveyed firms
- 43% of all cyber breaches targeted SMBs, despite them representing only 30% of the market economy
- 44% of SMBs recovered fully from ransomware within 24 hours due to backups
- Average SMB breach detection time: 277 days, with containment in 84 days
- 54% of SMBs restored operations within a week post-incident using offsite backups
- 81% of SMBs lack formal cybersecurity training programs, leading to higher vulnerability
- Only 26% of SMBs use multi-factor authentication (MFA) across all accounts
- 57% of SMBs have not updated antivirus software in over 6 months
- Ransomware accounted for 24% of SMB malware detections in 2023, with LockBit variant at 41% share
- Phishing emails targeting SMBs increased 15% YoY, with 91% containing malicious links or attachments
- DDoS attacks on SMBs lasted average 45 hours, peaking at 1.2 Tbps volume
In 2023, SMBs faced costly attacks with phishing dominant, averaging $4.45 million per breach.
Related reading
01 · Category
Financial Losses22 stats
01
Average SMB data breach cost reached $4.45 million in 2023, up 15% from 2022
02
Ransomware payments by SMBs averaged $1.54 million per incident, with 46% paying demands
03
Phishing-related losses for SMBs totaled $52 million quarterly in US
04
Downtime from DDoS cost SMBs average $40,000per hour
05
BEC fraud drained $43 billion from SMBs globally 2021-2023
06
Data recovery post-breach averaged $25,000for SMBs under 500 employees
07
Notification costs after SMB breaches hit $0.25 million on average
08
Lost business revenue from breaches equaled 36% of total SMB costs
09
SMB insurance premiums rose 25% post-incident, averaging $18,000 annually
10
Supply chain breach ripple effects cost SMBs $1.2 million in disruptions
11
Credential breach fines under GDPR averaged €450,000 for EU SMBs
12
Malware cleanup expenses reached $150,000per SMB incident
13
Legal fees from class actions post-breach: $500,000for SMBs
14
Productivity losses from cyber incidents: 1,200 hours per SMB employee annually, valued at $60,000
15
Cloud breach misconfig costs SMBs $100,000in data storage fees
16
Ransomware decryption failures led to $2 million data loss value for SMBs
17
IoT breach remediation: $75,000average for SMB networks
18
BEC recovery efforts cost $200,000including forensics
19
Post-breach customer churn: 22%, equating to $300,000 revenue loss yearly
20
DDoS mitigation subscriptions jumped to $12,000/year post-attack for SMBs
21
Insider threat investigations: $110,000per case for SMBs
22
API breach penalties: $250,000under PCI-DSS for SMBs
Interpretation
Financial Losses Interpretation
A staggering price tag underscores the grim reality for small businesses: cyber threats are now a catastrophic tax on entrepreneurship, where every click carries the weight of potential financial ruin.
02 · Category
Prevalence of Attacks30 stats
01
In 2023, 61% of small and medium-sized businesses (SMBs) experienced at least one cyber attack, with phishing being the most common vector accounting for 36% of incidents
02
SMBs with fewer than 100 employees faced a 28% increase in ransomware attacks compared to 2022, totaling over 1.2 million attempts blocked across surveyed firms
03
43% of all cyber breaches targeted SMBs, despite them representing only 30% of the market economy
04
During Q4 2023, SMBs reported a 15% rise in DDoS attacks, averaging 2.5 attacks per business per month
05
74% of SMBs in the US suffered a cyber incident in the past year, with retail sector hit hardest at 82%
06
Global SMB cyber attack volume reached 2.4 billion in 2023, a 22% YoY increase
07
52% of SMBs experienced phishing attempts weekly, leading to 14% successful compromises
08
In Europe, SMBs saw a 31% surge in malware infections, with 68% undetected for over 30 days
09
39% of SMBs reported supply chain attacks affecting their operations in 2023
10
Australian SMBs faced 1.8 cyber incidents per firm annually, up 19% from prior year
11
67% of SMBs in manufacturing sector reported IoT-related attacks, averaging 45 exploits per device
12
UK SMBs experienced 25% more BEC scams, costing average £45,000 per incident
13
55% of SMBs globally reported increased attack frequency post-COVID
14
In 2023, SMB cloud misconfigurations led to 41% of data exposures
15
48% of SMBs in healthcare faced HIPAA-violating phishing
16
Canadian SMBs saw 29% rise in credential stuffing attacks
17
62% of SMBs reported insider threat incidents, mostly accidental
18
Asia-Pacific SMBs experienced 3.2 billion attack attempts in H1 2023
19
71% of SMBs with remote work reported VPN exploits
20
Latin American SMBs faced 34% increase in mobile malware
21
53% of SMBs in finance sector hit by API vulnerabilities
22
Middle East SMBs saw 27% DDoS volume growth
23
59% of SMBs reported social engineering successes
24
US SMBs averaged 4.5 attacks per week in 2023
25
66% of SMBs in education faced ransomware
26
African SMBs reported 22% exploit kit usage in attacks
27
49% of SMBs experienced zero-day exploits
28
SMBs in construction saw 38% rise in wiper malware
29
64% of SMBs reported multi-vector attacks quarterly
30
Global SMB IoT attack surface grew 25%, with 1.7M vulnerabilities
Interpretation
Prevalence of Attacks Interpretation
The grim truth hiding behind these statistics is that the global digital economy now runs on a charmingly naive and profoundly vulnerable network of small businesses who, statistically speaking, are currently being digitally mugged while also trying to run a bakery.
03 · Category
Recovery and Resilience30 stats
01
44% of SMBs recovered fully from ransomware within 24 hours due to backups
02
Average SMB breach detection time: 277 days, with containment in 84 days
03
54% of SMBs restored operations within a week post-incident using offsite backups
04
Cyber insurance claims approved for 78% of SMB ransomware cases, accelerating recovery
05
37% of SMBs experienced no long-term damage after MFA implementation post-breach
06
Incident response teams reformed in 49% of SMBs within 30 days of major breach
07
Data restoration success rate: 92% for SMBs with 3-2-1 backup rule compliance
08
61% of SMBs reduced future risks by 40% after tabletop exercises
09
Post-breach, 52% of SMBs achieved compliance with NIST frameworks within 6 months
10
Resilience score improved 35% for SMBs adopting EDR post-incident
11
68% of insured SMBs resumed business in under 72 hours after DDoS
12
Forensic analysis shortened MTTR by 50% in 45% of SMB recoveries
13
Employee retraining post-phishing cut repeat incidents by 63% in SMBs
14
Cloud migration post-breach enhanced resilience for 71% of SMBs
15
Zero-downtime recovery achieved by 29% of SMBs with hyper-converged infrastructure
16
55% of SMBs rebuilt trust via transparency reports after breaches
17
Partnership with MSSPs improved recovery time by 60% for 47% SMBs
18
Immutable backups prevented re-encryption in 82% of SMB ransomware recoveries
19
Annual resilience audits adopted by 38% of SMBs post-incident
20
AI-driven threat hunting restored 66% of SMBs faster than manual methods
21
73% of SMBs with cyber drills contained incidents under 24 hours
22
Supply chain vetting post-breach reduced secondary risks by 51% in SMBs
23
Quantum-safe encryption trials boosted long-term resilience in 21% SMBs
24
Community sharing via ISACs helped 39% SMBs in sector-wide recoveries
25
64% of SMBs reported stronger vendor negotiations post-recovery success
26
Automated rollback systems enabled 53% SMBs to revert breaches instantly
27
59% of SMBs achieved carbon-neutral recovery ops via green data centers
28
Peer benchmarking post-incident improved metrics for 42% SMBs
29
Blockchain audit trails aided forensic recovery in 25% advanced SMB cases
30
48% of SMBs integrated XDR for holistic resilience post-multiple breaches
Interpretation
Recovery and Resilience Interpretation
While SMBs often emerge from cyberattacks with surprisingly quick technical recoveries thanks to robust backups, their true resilience story is a slow, sobering saga of taking nearly nine months to even detect the breach in the first place.
More related reading
04 · Category
Security Practices24 stats
01
81% of SMBs lack formal cybersecurity training programs, leading to higher vulnerability
02
Only 26% of SMBs use multi-factor authentication (MFA) across all accounts
03
57% of SMBs have not updated antivirus software in over 6 months
04
Just 34% of SMBs conduct regular vulnerability scans, quarterly or more
05
72% of SMBs fail to segment their networks, increasing lateral movement risk
06
Only 19% of SMBs have incident response plans tested annually
07
65% of SMBs use default credentials on devices
08
48% of SMBs lack endpoint detection and response (EDR) tools
09
Employee phishing simulation training covers only 41% of SMB staff yearly
10
69% of SMBs do not encrypt sensitive data at rest or in transit
11
Backup testing occurs in just 23% of SMBs monthly
12
55% of SMBs have unpatched software vulnerabilities over 90 days old
13
Zero-trust architecture adopted by only 14% of SMBs
14
76% of SMBs lack web application firewalls (WAF)
15
Security awareness training budget is under $1,000/year for 62% SMBs
16
51% of SMBs do not monitor privileged accounts
17
Email filtering solutions block only 89% of threats in SMBs
18
67% of SMBs have no mobile device management (MDM)
19
Patch management automated in 29% of SMB environments
20
73% of SMBs fail to conduct supplier security audits
21
SIEM tools deployed in only 17% of SMBs
22
59% of SMBs use single-sign-on (SSO) inadequately
23
Regular penetration testing done by 22% of SMBs annually
24
Data loss prevention (DLP) policies in place for 31% of SMBs
Interpretation
Security Practices Interpretation
These statistics paint a grim picture of small businesses essentially running through a digital minefield wearing a "Kick Me" sign while using an "Admin/1234" password.
05 · Category
Types of Threats24 stats
01
Ransomware accounted for 24% of SMB malware detections in 2023, with LockBit variant at 41% share
02
Phishing emails targeting SMBs increased 15% YoY, with 91% containing malicious links or attachments
03
DDoS attacks on SMBs lasted average 45 hours, peaking at 1.2 Tbps volume
04
BEC scams defrauded SMBs of $2.9 billion in 2023, average loss $120,000 per incident
05
Supply chain compromises affected 18% of SMBs, via third-party software updates
06
Malware variants hit SMBs 3.4 times more than enterprises, with trojans at 29%
07
Credential theft via infostealers impacted 52% of SMBs, harvesting 1.5B credentials yearly
08
Zero-day exploits used in 12% of SMB breaches, primarily via browsers
09
IoT botnets like Mirai variants launched 67% of SMB DDoS
10
Account takeover (ATO) via SMS MFA bypass hit 31% of SMBs
11
Wiper malware destroyed data in 8% of SMB ransomware cases
12
Cryptojacking consumed 22% of SMB cloud CPU resources undetected
13
Insider threats caused 34% of SMB incidents, with 78% unintentional
14
Mobile phishing (smishing) rose 61% against SMBs
15
API attacks exploited weak auth in 27% of SMB web apps
16
Fileless malware evaded 45% of SMB AV solutions
17
Deepfake voice scams tricked 14% of SMB finance teams
18
Shadow IT led to 39% of SMB SaaS breaches
19
Vishing calls compromised 23% of SMB helpdesks
20
RDP brute-force attempts hit 99% of SMBs monthly
21
DNS tunneling used in 17% of SMB data exfiltration
22
Watering hole attacks targeted 11% of SMB industry sites
23
Man-in-the-middle (MitM) via evil twin WiFi hit 28% remote SMB workers
24
Logic bombs activated in 6% of SMB insider incidents
Interpretation
Types of Threats Interpretation
Small businesses are being served an overwhelming cybersecurity buffet where the specials include a ransomware platter, a side of drained bank accounts, and an incredible variety of ways to fail, proving it's time for a very serious course correction.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Timothy Grant. (2026, February 13). Smb Cybersecurity Statistics. Gitnux. https://gitnux.org/smb-cybersecurity-statistics
MLA
Timothy Grant. "Smb Cybersecurity Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/smb-cybersecurity-statistics.
Chicago
Timothy Grant. 2026. "Smb Cybersecurity Statistics." Gitnux. https://gitnux.org/smb-cybersecurity-statistics.
Sources & references
85 datasets cited across this report · attribution is report-level
akamai.com