Do hackers target small businesses?

A close-up photograph of coding on a computer screen.

As cybercrime reports rise, are small businesses at risk of cyberattacks? If you're not a multi-billion-dollar company, are you still a target?

Unfortunately, the answer is yes.

Cybercriminals don't discriminate by business size. Money is money, after all, and criminals often don't care where they get it. Rather than target individuals, hackers will often cast a wide net of attacks to see what they catch.

And this method has reaped massive rewards. The cybercrime industry is estimated to reach $10.5 trillion annually by 2025.

So what can you do to protect yourself from attacks? Good cybersecurity practices can help protect both large and small businesses.

For over 25 years, WEBIT Services has helped hundreds of clients build effective cybersecurity procedures and strategies.

By reading this article, you will learn what cybercriminals want, how they attack, and how to keep your business safe.

 

What cybercriminals want

For the most part, cybercrime is motivated by making a profit. For example, the average cost of a data breach in 2022 is $4.35 million.

Many cyberattacks will focus on making money through ransomware or cyber extortion.

Ransomware attacks one or more primary systems through encryption, making them unusable. Your company's productivity halts until you pay the ransom.

Cyber extortion attacks steal confidential data and threaten to release it publicly. Often, releasing this data will be detrimental to your business. As such, cybercriminals will demand a high price to keep it a secret.

However, there's no guarantee that the criminals will halt the attacks if paid.

Some ransomware criminals may launch a successful attack but lack the skill to undo the encryption they created. If this happens, experts must either break the code or recreate the system using backups. If they cannot, your system is unusable.

With cyber extortion, payment demands could continue until the stolen data no longer has value. There's also no guarantee that cybercriminals will not sell or release the data even if you pay the ransom.

In essence, once a cybercriminal has stolen your data, you have little to no control over how they use it and when they stop using it.

Other cyberattack motivations

However, some cybercrime is sponsored by nation-states and focuses on disrupting infrastructure. While these attacks focus primarily on creating chaos or causing harm, they can also have monetary goals.

Other cyberattacks steal intellectual property (i.e., product designs or recipes). Unfortunately, if cybercriminals produce your goods, you cannot force them to take the goods off the market or sue them. Once they have the IP, it's out of your hands.

On occasion, some cyberattacks come from unhappy former employees. Angry former employees may delete data if employee access is not correctly removed from IT systems. This is considered a cyberattack.

 

Do small businesses have something cybercriminals want?

For cybercriminals, a business does not need to be a major corporation to hold immense value. Even small companies have data and money, the two things cybercriminals want the most.

Cybercriminals are looking for easy access to any system that holds data. Whether this is a large, medium, or small business doesn't matter. Information is profitable regardless of its origin.

If cybercriminals feel they can freeze your system through ransomware and demand payment, they will.

If you have any confidential data, cybercriminals will find this valuable.

If you have the intellectual property, cybercriminals will want this to make themselves, hold for ransom, or to sell on the black market.

 

How cybercriminals attack

Contrary to popular belief, cybercriminals rarely select their victims. Yes, some attack specific targets, but most cyberattacks are entirely random.

Most cyberattacks occur through "social engineering" campaigns. These are more "scattershot attacks."

These attacks may be phishing emails, fake alerts, pop-ups, or other scams that try to convince users to give up their login credentials willingly.

Once someone unwittingly takes the bait, cybercriminals can infect their systems. Cybercriminals won't turn away free access to data, no matter how small a company may be.

Once inside, cybercriminals can sit in silence for months, learning your IT system until they can launch their attack.

For example, ransomware cybercriminals will learn which systems are the most vital and where the backups are. This allows them to target and encrypt the crucial systems while wiping out your backups, crippling your technology.

 

Protecting your business from cybercrime

No business is too small for a cyberattack, so it's essential to have good cybersecurity practices and an incident response plan.

Implementing cybersecurity practices

Cybersecurity practices are only as effective as the people using them.

Creating cybersecurity practices for your entire organization and utilizing regular cybersecurity training are foundational for effective cybersecurity.

Other practices include:

Creating an incident response plan

An incident response plan answers the questions, "What do I do if I suddenly can't provide goods or services to my customers? How much money do I lose each hour my business isn't operable?"

When a crucial system goes down, ask yourself and your IT provider:

  • Who do you call in an IT crisis?
  • How long will it take to fix the system?
  • What is your plan for a crisis? Do you have a plan?
  • What happens to our data?
  • How long would it take us to recover?
  • Are the backups on a separate network?

Having a good response plan can help minimize downtime and financial losses.

 

Next steps for protecting your small business

Cybercriminals do not discriminate based on business size. Because most of their attacks are random mass campaigns, they will target anyone willing to give up their login credentials.

Cybercriminals will attack to:

  • Find valuable data.
  • Launch a ransomware attack.
  • Exploit confidential information.
  • Disrupt infrastructures.
  • Steal intellectual property.

Talk to your IT provider, managed security service, or internal IT team to discuss your risks, cybersecurity practices, and incident response plan to protect your business.

If your IT provider has failed to run quarterly risk assessments or discuss an incident response plan, this is a red flag for poor cybersecurity practices. In this case, you should consider looking for a new provider.

WEBIT Services is passionate about cybersecurity practices and education. It sees knowledge and awareness as the first step in developing effective cybersecurity procedures.

If you are looking for a new IT provider, schedule a free 30-minute consultation to see if WEBIT can help.

If you're not ready to make a commitment but would like to learn more about cybersecurity, we recommend the following articles: