If you run a small business and still think you’re too small to be a target, the numbers say otherwise. Below are the most important, sourced small business cybersecurity statistics for 2026 — organised so you can find, cite, and act on them.
Quick answer: Small businesses are now the primary target for cyberattacks. According to Verizon’s 2025 DBIR, ransomware was involved in 88% of small-business breaches (vs 39% at large firms), and survey data from PreVeil found 61% of small businesses suffered a breach in the past year. SMBs are hit harder mainly because they have fewer defenses, not less valuable data.
Every figure below is attributed to its source. Statistics are updated periodically; always check the original report for the latest numbers.
The headline numbers
- 88% of small-business breaches involved ransomware, compared with 39% at large organizations. (Verizon 2025 DBIR)
- 61% of small businesses experienced a breach in the past year. (PreVeil, 2025)
- 79% of SMBs faced at least one cyberattack in the past five years. (Coalition, 2025)
- Small businesses receive the highest rate of malicious email of any size category — about 1 in 323 emails. (Verizon DBIR / StrongDM)
- 75% of SMB owners rank cyberattacks as their #1 operational threat heading into 2026. (VikingCloud)
How often are small businesses attacked?
Attacks on small businesses are frequent and rising. Smaller firms account for a disproportionate share of incidents because automated attacks don’t discriminate by company size — and SMBs are the softest targets.
- SMBs are roughly 3x more likely to be targeted than large enterprises. (StrongDM)
- In the UK, 41% of micro businesses and 50% of small businesses identified a breach or attack in 2025. (UK Government Cyber Security Breaches Survey)
- A common driver: a majority of SMB owners with no security in place believe they are “too small to be attacked” — the exact misconception attackers exploit. (StrongDM)
For the practical implications, see do hackers target small businesses? and how often are small businesses attacked?
Ransomware statistics for small businesses
Ransomware is now the defining SMB threat. Verizon’s 2025 DBIR found that across all organizations, ransomware appeared in 44% of breaches, up sharply from 32% the year before — but the burden falls hardest on small businesses.
| Statistic | Figure | Source |
|---|---|---|
| Breaches involving ransomware (all orgs) | 44% | Verizon 2025 DBIR |
| SMB breaches involving ransomware | 88% | Verizon 2025 DBIR |
| Large-org breaches involving ransomware | 39% | Verizon 2025 DBIR |
| Median ransom payment | $115,000 | Verizon 2025 DBIR |
| Victims who refused to pay | 64% | Verizon 2025 DBIR |
The takeaway for SMBs is clear: tested backups and EDR aren’t optional. See how to protect your small business from ransomware.
Phishing and the human element
People — not technology — remain the most common point of failure, and AI is making lures harder to spot.
- The human element is a factor in around 60% of breaches. (Verizon 2025 DBIR)
- AI-generated phishing emails roughly doubled year over year. (Verizon 2025 DBIR)
- Stolen credentials remain a leading entry point, contributing to roughly 22% of breaches. (Verizon 2025 DBIR)
This is why security awareness training and learning to spot phishing emails deliver such high returns for small teams.
Supply chain and third-party risk
- Breaches involving a third party doubled from 15% to 30% in a single year. (Verizon 2025 DBIR)
- Exploited vulnerabilities featured in roughly 1 in 5 attacks, up about 34%. (Verizon 2025 DBIR)
Your security is only as strong as the vendors and tools you connect to. More in supply chain attacks and small businesses.
What a breach actually costs
The financial impact lands disproportionately hard on small businesses, which have thinner cash reserves and less ability to absorb downtime.
- The widely cited average cost of a data breach sits in the multimillion-dollar range across all organizations, with SMB-specific incidents frequently cited around $3.3 million in aggregate impact when downtime and recovery are included. (StationX, summarising multiple 2025 sources)
- The median ransom payment alone — $115,000 — is enough to threaten the survival of many small firms. (Verizon 2025 DBIR)
Note on the “60% close within 6 months” claim: This frequently repeated statistic is widely circulated but poorly sourced and disputed. We avoid citing it as fact and recommend you do too. The well-documented reality — multimillion-dollar costs and six-figure ransoms — is alarming enough on its own.
Preparedness gap: why the numbers stay high
The attacks succeed because defenses lag. Small businesses consistently under-invest in the basics:
- A large share of SMBs lack a formal incident response plan, meaning many improvise during a crisis.
- Many still rely on traditional antivirus alone rather than EDR.
- MFA adoption, while rising, is still incomplete across critical accounts.
Closing this gap doesn’t require a big budget — it requires the five basics applied consistently.
How to use these statistics
If you’re citing these figures — in a board update, an insurance application, or a pitch for security budget — link to the primary sources (Verizon DBIR, the UK Government survey, Coalition, PreVeil) rather than secondary roundups. Primary reports carry more weight and stay accurate longer.
For the full picture and a step-by-step plan, start with our complete guide to small business cybersecurity.
Frequently asked questions
What percentage of cyberattacks target small businesses?
Estimates vary by methodology, but small and medium businesses account for a very large share of attacks — some analyses put it around half — because automated attacks target the weakest defenses, which SMBs tend to have.
How many small businesses get hacked?
Survey data from PreVeil found 61% of small businesses experienced a breach in the past year, and Coalition reported 79% faced at least one attack over five years.
Is ransomware really worse for small businesses?
Yes. Verizon’s 2025 DBIR found ransomware in 88% of small-business breaches versus 39% at large organizations — a roughly 2.3x gap — because SMBs lack the segmentation, monitoring, and recovery readiness larger firms have.
Where do these statistics come from?
The most authoritative sources are the Verizon Data Breach Investigations Report (DBIR), the UK Government Cyber Security Breaches Survey, and insurer/vendor research from Coalition, PreVeil, and others. Always prefer primary reports when citing.
Sources: Verizon 2025 Data Breach Investigations Report (DBIR); UK Government Cyber Security Breaches Survey 2025; Coalition 2025; PreVeil 2025; VikingCloud; StrongDM; StationX (secondary aggregation). Last updated June 2026.
Reviewed by Nhon Dang, CEO Sunteco Cloud. See our editorial guidelines.
