Small businesses increasingly operate online, yet many lack the defenses to withstand evolving cyber threats. The combination of more remote work, AI-powered attacks, and limited security budgets has pushed cyberattacks to new highs against small firms. Real impact spans from lost revenue after ransomware to reputational harm when customer data is compromised. Restaurants, retail shops, and professional services now face threats once reserved for large corporations. Explore the key statistics that shape the understanding of small business cybersecurity in today’s landscape.
Editor’s Choice
- An estimated 43% of small businesses experienced a cyberattack in 2025, nearly half of all SMBs.
- 27% of small businesses reported being targeted in the past 12 months alone.
- Small businesses are three times more likely to be targeted by cybercriminals than larger enterprises.
- 43% of all cyberattacks globally hit small businesses, underscoring their vulnerability.
- Phishing remains a leading vector, with daily phishing emails at over 3.4 billion globally in 2025.
- Ransomware groups saw victims double in 2025, with thousands of incidents reported worldwide.
- 60% of small businesses that suffer severe cyberattacks go out of business within six months.
Recent Developments
- AI-powered attacks are growing, with identity exploitation playing a major role in breaches.
- Attackers are using automated tools to compromise systems more quickly, shrinking response time.
- The number of active ransomware groups hit record levels in 2025, driving attack volume.
- Social engineering tactics like phishing are evolving with AI tools to craft more convincing lures.
- More small business owners report declining confidence in preparedness, with fewer feeling “very prepared” year over year.
- Cybercriminal operations increasingly coordinate across networks, outpacing fragmented small business defenses.
Overview of Small Business Cyber Attack Statistics in 2025–2026
- Nearly 43% of small businesses faced a cyberattack in 2025.
- 27% reported attacks within the past 12 months, a high rate of recent targeting.
- Small businesses represent roughly 43% of all cyberattacks globally.
- Daily phishing volumes exceeded 3.4 billion in 2025, a persistent threat vector.
- Ransomware victims more than doubled compared to prior years, indicating rapid growth.
- Most attackers exploit human error and weak identity controls to gain entry.
- Small business confidence in cyber readiness has declined year over year.
- Cyberattacks are dispersed across industries, indicating no sector is immune.
Impact of Cyber Attacks on Small Businesses
- System downtime and reduced productivity affect 30% of small businesses after a cyber attack, making it the most common operational disruption.
- Lost revenue impacts 28% of affected companies, showing how cyber incidents directly reduce cash flow and profitability.
- Loss of customers’ trust hits 16% of businesses, highlighting long-term challenges in brand credibility and customer retention.
- Permanent loss of business-critical data affects 16%, increasing risks related to compliance, recovery costs, and service continuity.
- Loss of future business opportunities and sales impacts 16%, limiting growth potential and market expansion.
- Legal expenses affect 14% of small businesses, with companies paying attorney fees for cyber-related disputes and compliance issues.
- Damage to equipment and machinery impacts 14%, adding unexpected repair and replacement costs.
- Regulatory fines and penalties affect 14%, showing how cyber incidents can trigger financial and legal consequences.
- Lawsuits are filed against 13% of affected businesses, increasing exposure to reputation risks and settlement costs.
- Damage to business reputation affects 13%, making it harder for companies to attract customers, partners, and investors.
How Often Small Businesses Are Targeted by Cyber Attacks
- Small businesses, on average, suffer an attack about every 11 seconds in 2025.
- 27% targeted in the last 12 months, a significant recurring incidence.
- Many small firms may see attacks multiple times per year, especially if initial defenses are weak.
- Up to 31% of attacked businesses estimate weekly attack attempts.
- Phishing remains constant and relentless, with billions of daily attempts.
- Automated AI bot traffic and credential testing increase the sheer volume of targeting.
- Even basic systems without defenses face frequent probing by attackers.
- Attacks are no longer sporadic but part of systemic digital risk exposure.
Share of All Cyber Attacks That Hit Small Businesses
- 43% of all cyberattacks globally target small businesses with fewer than 1,000 employees.
- 46% of cyber breaches impact firms with under 1,000 employees.
- Small businesses face cyberattacks every 11 seconds on average.
- 75% of small businesses experienced at least one cyberattack in the past year.
- Phishing accounts for 33.8% of all breaches against small businesses.
- 82% of ransomware attacks targeted companies with fewer than 1,000 employees.
- Small businesses receive 350% more social engineering attacks than large enterprises.
- 67.4% of phishing attacks in 2024 used AI, rising further in 2025.
- Up to 95% of cyberattacks start with phishing, heavily targeting SMBs.
Cyber Attack Statistics by Business Size and Employee Count
- Businesses with fewer than 50 employees account for nearly 30% of all reported data breaches.
- Companies with under 100 employees face 43% of cyberattacks aimed at small organizations.
- Verizon’s 2024 DBIR shows 61% of breach victims had fewer than 1,000 employees.
- Microbusinesses (<10 employees) see over 50% experiencing weekly phishing attempts.
- IBM’s 2024 report: Small organizations (<500 employees) average $3.31 million breach cost.
- Small firms without IT staff are twice as likely to suffer extended downtime post-attack.
- 50–249 employee businesses report higher ransomware payment rates vs those with cybersecurity teams.
- Hybrid/remote organizations saw 15% higher breach frequency than fully onsite operations.
Industry and Sector Breakdown of Small Business Cyber Attacks
- Healthcare SMBs faced 21.82% of all cyberattacks in India per the 2025 report.
- Retail SMBs lost $103 billion to fraudulent returns and claims globally in 2024.
- Financial services SMBs encountered ransomware in 65% of organizations in 2024.
- Manufacturing SMBs reported 15% of breaches from supply chain attacks in 2025.
- Professional services SMBs saw 33% of breaches from BEC attacks costing $50,000 average.
- Construction SMBs lost over $1.2 billion to real estate-related BEC scams in 2023.
- Hospitality SMBs encountered malware in 24% of attacks alongside POS risks.
- Education small institutions had 116 confirmed ransomware attacks in 2024.
- 43% of all SMBs faced at least one cyber attack in the past 12 months.
Cyber Attack Trends on Small Businesses by Region and Country
- In the United States, 43% of all cyberattacks target small businesses with under 1,000 employees.
- North America SMBs face attacks every 11 seconds, with 46% experiencing incidents annually.
- European small businesses report 84% suffered phishing attacks in the past year.
- UK businesses endured 7.78 million cyber attacks, 53% hit monthly or more.
- Australian SMBs see 28% of breaches from ransomware in 2024.
- Canada’s small businesses had 73% cybersecurity incidents by late 2024.
- Asia Pacific SMBs lost customer data in 75% of cyber incidents last year.
- Latin American organizations face 2,716 cyber attacks weekly, 39% above the global average.
- Ransomware claims 45.79% of Canadian SME cyber incidents, averaging $1.34M CAD.
Ransomware Statistics for Small Businesses
- 66% of organizations were hit by ransomware in 2024, up from the prior year.
- The average ransom payment reached $1.54 million in 2024, reflecting increased demands.
- Small businesses often pay smaller sums, but recovery costs exceed ransom payments by multiple factors.
- Downtime from ransomware averages 24 days for smaller firms, disrupting revenue cycles.
- 32% of SMBs reported paying ransom to regain data access.
- Backup strategies reduced ransom payments by over 40% among prepared businesses.
- Healthcare SMBs experienced the highest ransomware recovery costs.
- Double extortion tactics now appear in over 70% of ransomware cases, adding reputational risk.
Phishing and Social Engineering Statistics for Small Businesses
- Phishing accounted for 36% of breaches globally in 2024–2025.
- 3.4 billion phishing emails are sent daily worldwide.
- Human error contributes to 74% of data breaches, often linked to social engineering.
- Business email compromise scams generated $2.9 billion in reported losses in 2023 in the U.S.
- AI-generated phishing emails show significantly higher click-through rates compared to traditional spam.
- 60% of small businesses lack regular phishing simulation training.
- Multi-factor authentication reduces account compromise risk by over 99%.
- SMS phishing, smishing, increased by over 40% year over year.
Malware and Virus Attack Statistics for Small Businesses
- Malware infections in SMBs rose 5% year-over-year to 138,046 in early 2024.
- 43% of small businesses faced cyber attacks in the past 12 months, many involving malware.
- Malware infections targeted 92% of SMBs via email in 2024, with a 358% increase.
- Fileless malware featured in over 40% of cyberattacks in 2023, rising into 2024 for SMBs.
- Microsoft blocked 7,000 password attacks per second in 2024, targeting small business accounts.
- Trojans were the top malware threat for SMBs, mimicking legitimate software in 2024.
- Over 60% of small businesses lack endpoint protection, increasing malware vulnerability.
- Malware disguised as cloud tools like Zoom hit nearly 8,500 SMB users in early 2025.
- SMBs using outdated systems face double the malware infection rate of patched ones.
Breakdown of Common Cyber Attack Types
- Malware attacks lead the landscape, accounting for 18% of all reported cyber incidents, making them the most common threat vector.
- Phishing attacks follow closely at 17%, highlighting the continued effectiveness of social engineering tactics against users and organizations.
- Data breaches represent 16% of cyber attacks, underscoring the persistent risk to sensitive and confidential data.
- Website hacking contributes 15%, showing that public-facing websites remain highly vulnerable to exploitation.
- DDoS attacks make up 12%, reflecting their role in causing service outages and operational disruption.
- Other attack types also account for 12%, indicating a diverse range of emerging and less common threats.
- Ransomware accounts for 10%, the smallest share, but it remains one of the most financially damaging cyber threats.
Data Breach and Data Loss Statistics in Small Businesses
- The global average cost of a data breach reached $4.45 million in 2023, up 15% over three years.
- For organizations with fewer than 500 employees, the average breach cost was approximately $3.31 million.
- 74% of breaches involve the human element, including social engineering or misuse of credentials.
- The average time to identify and contain a breach globally is 277 days, increasing the total impact.
- Compromised credentials remain the most common breach cause, responsible for 19% of incidents.
- Cloud misconfigurations contribute significantly to small business data exposure cases.
- Ransomware-related breaches often include data exfiltration, with double extortion present in over 70% of cases.
- Customer personally identifiable information remains the most targeted data type across SMB breaches.
Downtime and Operational Disruption Statistics for Small Businesses
- Average ransomware recovery time for small businesses exceeds 24 days, delaying revenue.
- 51% of small businesses experience website downtime of 8-24 hours post-attack.
- 50% of SMBs require over 24 hours for cyberattack recovery.
- Cloud-based ransomware causes a 24-day average downtime for affected firms.
- Firms lacking tested backups face 50% longer recovery periods.
- 54% of small businesses report IT staff shortages during incidents.
- Manufacturing SMBs endured 532 ransomware attacks in Q3, disrupting operations.
- 40% of small firms incur revenue losses averaging $25K per downtime day.
- Service businesses face SLA penalties of up to $15,000 daily for outages.
Expected Cyberattack Costs for Small Businesses
- 39% of small businesses expect a cyberattack to cost between $500,000 and $2,000,000, making this the most common cost range.
- Nearly 30% of businesses believe a cyber incident would cost less than $500,000, indicating that many still expect moderate financial damage.
- About 31% of small businesses anticipate losses of more than $2,000,000, highlighting the risk of severe financial impact.
- Overall, 70% of businesses estimate cyberattack costs could exceed $500,000, showing that major losses are a widespread concern.
- The data suggests that most small firms recognize cybersecurity threats as a high-cost business risk, not just a technical issue.
- With nearly one-third facing potential multi-million-dollar losses, proactive investment in cybersecurity is becoming essential.
- These figures emphasize that even smaller organizations are financially vulnerable to large-scale cyber incidents.
Business Closure and Bankruptcy Rates After Cyber Attacks on Small Businesses
- 60% of small businesses close within six months of a significant cyberattack.
- 25% of SMBs file for bankruptcy after a severe ransomware event.
- Small retailers face elevated permanent closure rates post major data breaches.
- Lack of cyber insurance boosts business closure risk by 3x for small firms.
- Businesses without an incident response plan are 2x more likely to shut down post cyber crisis.
- Recovery costs surpass emergency reserves in 70% of microbusinesses after attacks.
- Customer trust erosion triggers a 30-50% revenue decline following publicized breaches.
- Smaller firms struggle to regain vendor relationships in 82% of high-profile incidents.
- 89% of breached SMBs report lasting reputational damage impacting survival.
Small Business Cybersecurity Readiness and Preparedness Statistics
- Only 14% of small businesses rate their cybersecurity posture as highly effective.
- 47% of SMBs report a limited understanding of cyber risks.
- Multi-factor authentication adoption significantly reduces compromise risk by over 99%.
- 60% of SMBs lack formal cybersecurity training programs.
- Small businesses with incident response plans reduce breach costs by hundreds of thousands of dollars on average.
- Regular patch management cuts exploit-based attacks dramatically.
- SMBs using managed security service providers report fewer successful intrusions.
- Cyber insurance adoption increased in 2024, reflecting higher perceived risk.
Cyber Risk Concern Levels Among Businesses (Next Year)
- A strong majority, 67% of businesses, say they are somewhat concerned about cyber risks impacting their operations in the coming year, highlighting widespread awareness of digital threats.
- One in five organizations, 20%, report being very concerned, showing that a significant portion views cyber threats as a critical business risk.
- Only 12% of respondents are not very concerned, indicating that relatively few businesses underestimate cybersecurity risks.
- A very small share, just 2%, are not concerned at all, suggesting that cyber risk is now recognized as a serious issue by nearly all companies.
- Overall, 87% of businesses are at least somewhat concerned about cyber risks, reflecting the growing importance of investing in strong cybersecurity strategies and risk management frameworks.
Small Business Cybersecurity Budget, Spending, and Investment Statistics
- SMBs allocate an average of 13.2% of their IT budget to cybersecurity in 2025.
- 29% of SMBs spend less than 5% of their IT budget on cyber defenses.
- SMB cybersecurity spending grew by 9.4% globally to $90 billion in 2024.
- 63% of small businesses increased cyber defense funds in 2025.
- 66% of SMBs cite cost as the top barrier to advanced security tools.
- Firms with higher security budgets experience fewer breaches, per industry benchmarks.
- Endpoint protection and email security are top SMB spending priorities.
- MDR adoption among SMBs rose 67% from 2021-2022, aiding teams without in-house expertise.
- Cloud security tools drive the fastest SMB investment growth at 15% CAGR.
- 55% of SMBs would shut down from a $50,000 cyber loss.
Future Cyber Threat Trends and Forecasts for Small Businesses
- Global cybercrime damages are projected to reach $10.5 trillion annually by 2025.
- AI-driven phishing and malware attacks are expected to surge by 703% through 2026.
- Zero-day exploits grew to over 21,500 CVEs in 2025 H1, hitting SMB systems.
- Cloud-targeted attacks on SMBs rise as 68% boost adoption by 2026.
- Ransomware hits 88% of SMB breaches, up 40% projected by 2026.
- 20 U.S. states enforce data privacy laws by 2026, pressuring SMB compliance.
- Cyber insurance premiums for SMBs up 25%+ due to stricter underwriting.
- Cybersecurity training delivers 1,900% ROI, preventing $120k–$3.3M breaches.
- 43% of SMBs face yearly attacks, averaging $254k in costs.
- 83% of SMBs see AI threats escalate, needing urgent workforce prep.
Frequently Asked Questions (FAQs)
What percentage of cyberattacks target small businesses annually?
About 43% of all cyberattacks target small businesses each year.
What share of small businesses reported experiencing a breach in the last year?
Around 61% of small businesses reported experiencing a cyber breach in the past year.
How many ransomware incidents were reported in 2025, according to recent findings?
There were approximately 7,458 ransomware incidents reported in 2025.
What percentage of small businesses lack a formal cybersecurity plan?
Only about 14% of small businesses have a documented cybersecurity plan in place.
What is the average financial loss reported by SMBs per attack?
Small businesses lose an average of $25,000 per cyberattack incident.
Conclusion
Small businesses now operate in a threat environment that rivals that of large enterprises, yet they often lack comparable defenses. From phishing and ransomware to AI-enhanced malware, attack methods continue to evolve, increasing financial losses, downtime, and long-term reputational damage. The data clearly shows that proactive investment in training, multi-factor authentication, backups, and incident response planning significantly reduces risk. As cybercrime grows more sophisticated, small businesses that prioritize cybersecurity today will be better positioned to survive and compete tomorrow.
