Researchers at Barracuda Networks analyzed millions of emails across thousands of companies in 2021 and found that on average, an employee of a small business with less than 100 employees will experience 350% more social engineering attacks than an employee of a larger organization.
According to the report from Barracuda Networks “The smaller the organization, the more likely their employees are to be targets for an attack. SMBs are an attractive target for cybercriminals because collectively they have a substantial economic value and often lack security resources or expertise.”
And healthcare and banking industries are particularly at risk as they store massive amounts of PII (personally identifying information) and financial information.
On average, cyberattacks on small businesses cost around $25,000 in damages but can reach much higher numbers if not dealt with quickly. There’s also the cost of repairing your business reputation and lost trust, as well as the downtime and legal fees that may come with it.
61% of small to midsize businesses (SMB) reported at least one cyberattack during the last 12 months. And a study by CISCO revealed that 40% of those experienced over eight hours of downtime; as a result, causing significant financial damage. According to research by Cybersecurity Ventures, 60% of small businesses go out of business within six months of a security breach.
Email threats, phishing scams, and social engineering tactics are very common in cyberattacks against small businesses.
Social engineering, mostly involving phishing scams, is one of the biggest threats facing small businesses.
Phishing attacks are usually a fake email posing as a well-known brand or service, such as Microsoft 365, with the goal of tricking the victim into clicking the phishing link and providing login credentials. Once they have access to a company’s account, they can spread ransomware or malware from within.
According to the report from Barracuda Networks, 51% of social engineering attacks are phishing.
SMBs are targeted with the following attack types:
51% are phishing attacks
37% are scams
9% are business email compromise attacks
2% are extortion attacks
Business Email Compromise (BEC) has been the largest source of fraud for several years despite ransomware attacks grabbing most headlines.
According to the FBI’s 2021 annual report, BEC remains the biggest source of financial losses, which totaled $2.4 billion in 2021, up from an estimated $1.8 billion in 2020. "In 2021, BEC schemes resulted in 19,954 complaints with an adjusted loss of nearly $2.4 billion," said Paul Abbate, deputy director of the FBI, in an introduction to the report. "In 2021, heightened attention was brought to the urgent need for more cyber incident reporting to the federal government."
Ransomware and double extortion attacks are also becoming a major concern for small businesses. In a double extortion attack, bad actors infect an organization’s network using ransomware, which encrypts the company’s files.
The fraudsters then demand ransom in exchange for decrypting the data, but if the organization refuses to pay up, the bad actors threaten to publish the information. Even if an organization has strong security measures in place to restore their data, the threat of data exposure may still force them to pay the ransom.
CipherTrace data suggests that there has been “a nearly 500% increase in these attacks in the last year. On average, these attacks are increasing nearly 200% quarter over quarter.”
Another threat is poor employee cyber hygiene. Weak passwords, not changing passwords frequently, and a lack of multi-factor authentication are still common causes of security breaches for SMBs.
Additionally, employees that fall prey to social engineering tactics do not have much, if any, cybersecurity awareness training.
Here are some important cybersecurity statistics to open your eyes to the vulnerability small businesses face with today’s modern cyberattacks.
43% SMBs do not have any cybersecurity plan in place.
Many small business owners in America worry little about cyber security. For example, 56% weren’t concerned about becoming a data breach victim in 2022. And 24% of them said they were “not concerned at all.”
Many people fail to use multi-factor authentication (MFA). Twitter, recently revealed that only 2.3% of its users had activated MFA.
91% of small businesses haven’t purchased cyber liability insurance.
83% of small and medium-sized businesses are not financially prepared to recover from a cyberattack.
Only 37% of small businesses report having a dedicated IT or cybersecurity team.
Any organization entrusted with customer data must take cybersecurity seriously. Not only are data breaches expensive, but they can also ruin an organization's reputation.
Implementing cybersecurity tools and techniques does come with added costs, but the cost of a successful cyberattack can be enough to put a small company out of business.
Every company, no matter its size, need to take steps to tighten its cybersecurity posture in 2022. Invest in solid cybersecurity infrastructure, be prepared and create an incident response plan, train your team on security awareness, and get cyber insurance for your business.
Teknologize is a SOC 2 certified, Professional Technology Services company with clients throughout the Pacific Northwest. We have offices located in:
Questions about your IT or Cybersecurity? Give us a call today!
Byron Martin: Nov 19, 2024
Ah, the holiday season, when everything sparkles, sales soar, and your to-do list rivals Santa's naughty and nice list. For businesses, it's a time...
Byron Martin: Nov 11, 2024
IMPORTANT: Microsoft recently announced the official end of support for Windows 10 on October 14, 2025. After this date, while your...
Byron Martin
