Small business cybersecurity statistics: threats and readiness

Small business cybersecurity statistics from the major 2025 studies agree on three points: small firms are breached often, ransomware and stolen passwords drive most of it, and confidence in defenses is falling. The Identity Theft Resource Center (ITRC) surveyed 662 owners and executives at companies with 500 or fewer employees in August 2025 and found 81% had a security breach, a data breach or both in the prior year.

This report compiles Verizon's 2025 Data Breach Investigations Report (DBIR) and its small business snapshot, the ITRC's 2025 Business Impact Report, Mastercard's 2025 survey of more than 5,000 small and medium business owners, and the FBI Internet Crime Complaint Center's 2024 figures as summarized by Nacha. Each measures something different, so we note who was counted as we go.

Mostly through ransomware, stolen credentials and phishing. Verizon analyzed 22,052 security incidents and 12,195 confirmed breaches for its 2025 report. In its small business snapshot, ransomware was present in 88% of breaches at smaller organizations, compared with 39% at large ones. Three attack patterns (system intrusion, social engineering and basic web application attacks) accounted for 96% of small business breaches.

Stolen credentials were the most common hacking method in small business breaches at 33%, and social attacks made up 18%, almost all of them phishing. One caution on definitions: Verizon counts any organization with fewer than 1,000 employees as small, so a 15-person accounting office and a 900-person company sit in the same group. The pattern still holds for the smaller end, because the entry points (a reused password, a convincing email, an unpatched login page) are the same.

Across all organizations, Verizon found breaches involving a third party doubled from 15% to 30%, and exploitation of software vulnerabilities was the first step in 20% of breaches, up 34%. For a service business, third parties include the scheduling platform, the practice management system, the IT contractor and any vendor with a login.

Often more than the business can absorb. Of the businesses in the ITRC survey that were breached, 62.5% reported a total financial impact above $250,000 and 36.7% reported costs above $500,000. For the first time in that survey, 38.3% of small business leaders said they raised prices to cover the impact of an incident.

Mastercard's survey found 46% of small business owners had experienced a cyberattack on their current business, and nearly one in five of the businesses that suffered an attack went on to file for bankruptcy or close. 80% said they had to spend time rebuilding trust with clients and partners afterward. For a law firm, medical practice or financial advisor, that trust is the business.

Verizon reported a median ransom payment of $115,000 across the incidents it studied, and 64% of victim organizations did not pay, up from 50% two years earlier. Not paying is more common now, but recovery without a usable backup is slow and expensive either way.

It is one of the costliest forms of cybercrime. According to Nacha's summary of the FBI Internet Crime Complaint Center's 2024 annual report, the IC3 received 21,442 business email compromise complaints in 2024 with losses close to $2.8 billion, and nearly $8.5 billion in losses across 2022 to 2024. Total losses reported to the IC3 in 2024 reached $16.6 billion.

Business email compromise usually means a criminal takes over or imitates an email account and redirects a payment: a vendor invoice with new bank details, a closing statement with changed wiring instructions, a request from "the owner" to buy gift cards. Real estate, title, legal and accounting firms see these attempts constantly because they move large payments by email. The defense is mostly process: confirm any change in payment details by calling a known number, and protect email accounts with multi-factor authentication.

Most have a plan, few trust it, and basic protections are slipping. In Mastercard's survey, 86% of owners said they had done a cybersecurity risk assessment and had a prevention plan, but only 23% were very satisfied with that plan and 23% were very confident they could spot threats. 73% said getting employees to take cybersecurity seriously was a challenge.

The ITRC data shows the same drift. The share of leaders who felt very prepared for a cyberattack fell from 56.5% in 2024 to 38.4% in 2025, and use of multi-factor authentication fell from 33.6% to 27.2%. The ITRC also reported that AI-powered attacks were a root cause in more than 40% of the cyber events its respondents described, which makes phishing emails and fake voices harder to spot by instinct alone.

Any business that holds sensitive records or moves money by email. That includes medical, dental and therapy practices (patient records), law firms (privileged files and client funds), accounting and tax firms (Social Security numbers and bank details), insurance agencies, property managers (tenant applications and owner payouts) and real estate teams (closing payments). Hospitality and beauty businesses hold card data and large customer lists.

The studies here do not break results out by these industries, so we cannot rank them. What they show is that the methods used against small firms are general: stolen passwords, phishing, ransomware and payment redirection work against any business that has email, a shared drive and a few software logins.

The data points to a short list of fixes that cover most of the common entry points. None of them require a security team, and most can be done in a few weeks: Monvell's Platform and Operations work builds account access, backups and payment approval steps into the systems we set up, so the basics on this list are part of the build rather than an afterthought.

• Turn on multi-factor authentication for email, banking, payroll and every system that holds client data. Only 27.2% of small businesses in the ITRC survey use it, and stolen credentials were the top hacking method in Verizon's small business data.
• Use a password manager so staff stop reusing passwords across sites.
• Keep backups that ransomware cannot reach (offline or immutable copies) and test a restore. With ransomware in 88% of small business breaches, a working backup is the difference between a bad week and a closure.
• Write a payment verification rule: any change to bank or wiring details gets confirmed by phone using a number already on file.
• List every vendor with access to your systems, remove accounts for former staff and contractors, and turn on updates for software and website plugins.
• Run short, regular phishing awareness reminders. 73% of owners in Mastercard's survey said getting employees to take security seriously is hard, so make it routine instead of a one-time training.
• Write down who does what in the first hour of an incident: who calls the bank, the IT contact, the insurer and, where required, clients or regulators.

Verizon's DBIR figures come from its 2025 news release and its SMB snapshot; Verizon defines small businesses as those with fewer than 1,000 employees. The ITRC figures come from its December 2025 release on the 2025 Business Impact Report, an online survey of 662 small business owners and executives fielded in August 2025. Mastercard's figures come from its March 2025 article on a survey of more than 5,000 small and medium business owners across four continents; Mastercard did not publish field dates. The IC3 figures are from Nacha's April 2025 summary of the FBI's 2024 Internet Crime Report.

These are surveys and incident datasets, not a census of all businesses, and companies that sell security services sponsor some of them. We use them for direction and scale rather than precise rates.