Small Business Cyber Attack Statistics 2026: How Often, How Much, and Why

Small businesses are not attacked less than large ones. They are attacked more, pay a bigger share of their revenue when it goes wrong, and get far less coverage in the annual reports that budget decisions are built on. This page pulls the small business numbers out of those reports: Verizon, IBM, the FBI, Sophos, the insurers who pay the claims, and the Identity Theft Resource Center’s survey of business owners. Every figure carries its source. We update the page as each report is published.

How to cite: link to this page or to the primary source listed beside each figure. Where a figure is from a survey, the sample size is stated so you can judge it.

Key numbers at a glance

• 81% of small businesses reported a security or data breach in the past year. (ITRC 2025 Business Impact Report)
• 96% of ransomware victims whose size was known were small and medium-sized businesses. (Verizon 2026 DBIR)
• 98% of cyber insurance claims in a 10,402-claim study came from SMEs. (NetDiligence 2025)
• $264,000: the average total incident cost for an SME, up about 30% in a year. (NetDiligence 2025)
• 62.5% of breached small businesses put their total financial impact above $250,000. (ITRC 2025)

1. How often small businesses are attacked

• 81% of small businesses (500 or fewer employees) reported a security breach, a data breach, or both in the past year, in the Identity Theft Resource Center’s survey of 662 owners and executives. (ITRC 2025 Business Impact Report)
• 59% of small and medium-sized enterprises across the US, UK, France, Germany, Spain, Ireland and Portugal experienced a cyber attack in the last twelve months, in a survey of 5,750 businesses. 27% were hit by ransomware. (Hiscox Cyber Readiness Report 2025)
• 96% of ransomware victims whose size was known were small and medium-sized businesses, in Verizon’s analysis of more than 22,000 confirmed breaches. (Verizon 2026 Data Breach Investigations Report)
• A year earlier the same report found ransomware present in 88% of breaches at small businesses against 39% at large organizations. Ransomware is the small business breach. (Verizon 2025 DBIR)
• 98% of cyber insurance claims in a study of 10,402 claims came from small and medium-sized enterprises. Large companies were 2% of claims but more than half of the total incident cost. (NetDiligence Cyber Claims Study 2025)
• Over 40% of the incidents small businesses reported to the ITRC named an AI-powered attack as a root cause; 57% of Hiscox respondents said they had been hit through at least one AI-related vulnerability. (ITRC; Hiscox)

What this means for testing: attackers choose small businesses because the same tools work against many of them at once. The tests that matter are the ones that remove the common entry points: exposed services, weak credentials, and unpatched software. See external network penetration testing for the scope that covers all three.

Is it true that 43% of cyberattacks target small businesses?

Partly, but the figure is usually misquoted. It traces to Symantec’s 2016 Internet Security Threat Report, which found that in 2015 small organizations of 250 or fewer employees were the target of 43% of spear-phishing attacks, up from 18% in 2011. It was a share of spear-phishing campaigns in a single year, not of “all cyberattacks,” and the source report is now a decade old. (Symantec ISTR, Volume 21, 2016)

A separate and often-confused number comes from Verizon’s 2019 DBIR, which found that 43% of breaches involved small business victims, from an analysis of 41,686 incidents and 2,013 breaches. (Verizon 2019 DBIR) Both figures are real; neither says “43% of all cyberattacks target small businesses,” the form in which the claim usually travels.

The current primary-source picture is stronger than the slogan: 81% of small businesses reported a breach in the past year (ITRC 2025), and 96% of ransomware victims whose size was known were small and medium-sized businesses (Verizon 2026 DBIR). Cite those, with their sources, rather than the 2015 spear-phishing figure.

2. What an incident costs a small business

• $264,000: the average total incident cost for a small or medium-sized enterprise in the NetDiligence claims data, up about 30% year over year. Crisis services alone (forensics, legal, notification) averaged $152,000. (NetDiligence 2025)
• 62.5% of breached small businesses put their total financial impact above $250,000, and 36.7% above $500,000, up from 2024. (ITRC 2025 Business Impact Report)
• 38.3% of breached small business leaders said they raised prices to absorb the cost of an incident. The ITRC calls this the hidden cyber tax. (ITRC)
• 33% of attacked SMEs were hit with a substantial fine afterwards. 44% lost money to payment diversion fraud. 29% found it harder to win new business. (Hiscox 2025)
• For context, the average cost of a data breach across all organization sizes reached $4.99 million globally and $11.5 million in the United States in 2026. A small business does not pay that, but the per-record costs of notification, legal work and downtime are the same. (IBM Cost of a Data Breach Report 2026)
• Ransomware recovery cost an average of $1.7 million excluding any ransom, across 2,158 organizations hit in the past year. (Sophos State of Ransomware 2026)

Against those numbers, a fixed-price penetration test is the cheapest line in the budget. Our pricing page publishes the figures.

3. Ransomware and the small business

• Ransomware incidents at SMEs accounted for 81% of insurance claims with a business interruption component. (NetDiligence 2025)
• 80% of SMEs hit by ransomware paid the ransom, and only 60% of them recovered all or part of their data. 31% of payers received further demands. (Hiscox 2025)
• Across all sizes the picture is different: only 31% of ransomware victims in Verizon’s data paid, and Coalition reports 86% of its policyholders refused. Small businesses without a response plan pay more often than businesses with one. (Verizon 2026 DBIR; Coalition 2026 Cyber Claims Report)
• 34% of organizations with 100 to 250 employees stopped the ransomware attack before data was encrypted. The rest did not. (Sophos 2026)
• The median ransom payment fell below $140,000 in Verizon’s data. Ransomware operators have moved down-market, and the demands scale to what a smaller victim can pay. (Verizon 2026 DBIR)
• Ransomware was the most expensive claim type at $269,000 on average, and initial ransom demands rose 47% in 2025. (Coalition 2026)

What this means for testing: most smaller organizations did not stop ransomware before encryption. A ransomware readiness assessment starts from one phished laptop and shows how far an attacker would get, and whether the backups would survive.

See what a real pentest finds. Read our sample report to see exactly what an engagement delivers.

4. How attackers get in

• 31% of breaches now start with the exploitation of a software vulnerability, the first time in nineteen years of the DBIR that it beat stolen credentials as the top entry point. Credential abuse as the initial vector fell to 13%. (Verizon 2026 DBIR)
• 48% of breaches involved a third party, a 60% increase in one year. For a small business that means the vendor, the SaaS tool, or the outsourced IT provider. (Verizon 2026 DBIR)
• Among ransomware victims the root causes were malicious email 26%, phishing 24%, compromised credentials 23%, and exploited vulnerabilities 18%. 79% of attacks began with an identity-based approach. (Sophos 2026)
• 62% of breaches involved the human element, and social engineering on mobile devices succeeded 40% more often than email phishing. (Verizon 2026 DBIR)
• Only 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38%, while the median time to remediate rose from 32 to 43 days. (Verizon 2026 DBIR)
• Only 27.2% of small businesses said they had put critical controls such as multi-factor authentication in place in 2025, down from 33.6% the year before, while the share that felt very prepared fell from 56.5% to 38.4%. (ITRC 2025 Business Impact Report)

The pattern is the same one we see on engagements: an internet-facing system that nobody patched, a shared password, and a vendor connection nobody reviewed. External network and web application tests find the first two; phishing testing measures the third.

5. Business email compromise, the quiet one

• Business email compromise cost US victims $3.046 billion in reported losses in 2025, up from $2.77 billion, the largest loss category aimed at businesses. 86% of BEC losses moved by wire transfer or ACH. (FBI IC3 2025 Internet Crime Report)
• BEC was 31% of cyber insurance claims and funds transfer fraud another 27%. Together they were 58% of incidents. The average BEC loss was $27,000; the average funds transfer fraud loss was $141,000, and 52% of those frauds started with a compromised mailbox. (Coalition 2026)
• The average wire transfer requested in a BEC attack was $50,297 in the fourth quarter of 2025, and 69% of BEC attacks were sent from free webmail domains. (APWG Phishing Activity Trends Report, Q4 2025)
• 44.2% of vendor email compromise messages that were read were engaged with by employees. (Verizon 2026 DBIR)

What this means for testing: in a small business, the Microsoft 365 or Google Workspace tenant usually holds the mail, the files and the logins, and more than half of funds transfer frauds started in a compromised mailbox. A Microsoft 365 or Google Workspace security review checks MFA, inbox and forwarding rules, app consent and mail authentication in that tenant, from $4,200 for up to 250 users.

6. The scale of the problem in the United States

• The FBI received 1,008,597 internet crime complaints in 2025, about 3,000 a day, with reported losses of $20.877 billion, up 26% in a year. (FBI IC3 2025)
• The ITRC tracked a record 3,322 publicly reported data compromises in 2025, up 79% over five years. Financial services (739), healthcare (534), and professional services (478) led the count, all sectors with long tails of small firms. (ITRC 2025 Annual Data Breach Report)
• 70% of breach notices in 2025 gave no information about how the attack happened, up from 65%. Small businesses that were breached mostly cannot say how. (ITRC)
• Supply chain attacks affected 1,251 entities in 2025 against 660 in 2024. One compromised vendor becomes hundreds of small business breaches. (ITRC via HIPAA Journal)

7. What the numbers say to do

The reports agree on the order of operations for a business with no security team, and Implementation Group 1 of the CIS Controls sets out the same basics safeguard by safeguard:

1. Close the exposed surface. Vulnerability exploitation is the top entry point (31%), and exposed applications and systems were the entry point in 38% of ransomware attacks. An external penetration test or a vulnerability assessment shows what the internet sees.
2. Fix identity. 79% of ransomware attacks started with an identity attack, and 97% of identity attacks are password attacks. Phishing-resistant MFA blocks more than 99% of them. (Microsoft Digital Defense Report 2025)
3. Test the people. 62% of breaches involve a human. A phishing test shows the real click rate before an attacker measures it for you.
4. Get the paperwork right. 33% of attacked SMEs were fined. A test report that maps to SOC 2, PCI DSS or HIPAA is the evidence that keeps a breach from becoming a penalty.

Our small business penetration testing page describes how we scope a first engagement for a company without an internal security team, at a fixed price with a free retest. Nonprofits face the same small-team problem with donor data and volunteer accounts added, which our page on cybersecurity for nonprofits covers.

Related statistics

Part of our cybersecurity statistics hub. See also phishing attack statistics and cyber insurance claims statistics.

Sources

• Verizon, 2026 Data Breach Investigations Report (31,000+ incidents, 22,000 breaches, 2025 data) and 2019 DBIR (the origin of the “43% of breaches involved small business victims” figure)
• Symantec, Internet Security Threat Report, Volume 21, 2016 (the origin of the “43% of spear-phishing attacks” figure, 2015 data)
• Identity Theft Resource Center, 2025 Business Impact Report and 2025 Annual Data Breach Report
• Hiscox, Cyber Readiness Report 2025 (5,750 businesses)
• NetDiligence, Cyber Claims Study 2025 (10,402 claims)
• Coalition, 2026 Cyber Claims Report
• Sophos, The State of Ransomware 2026 (2,158 organizations)
• IBM, Cost of a Data Breach Report 2026 (602 organizations)
• FBI Internet Crime Complaint Center, 2025 Internet Crime Report
• APWG, Phishing Activity Trends Report, Q4 2025
• Microsoft, Digital Defense Report 2025