Why are even small companies targets for cybercriminals?

"We're just a small company, why would anyone want to break into our systems? Hackers probably don't even know we exist."

You still come across this misleading idea now and then. In reality, small companies can fall victim to cybercriminals even more often than large ones.

Why are criminals interested in smaller prey, when big companies have more and more valuable data? The answer is simple: most cybercriminals don't care who you are or what you do. They go wherever they can get in, and profit from whatever they can get their hands on.

Example: ransomware victims

For example, the ransomware.live website lists organisations that have fallen victim to criminal gangs using ransomware. The attackers break into systems, steal and lock the data, and demand a ransom for returning it and not publishing it.

At the time of writing, the most recent victims included, for example:

• a construction company of about 10 people,
• a financial services company of about 15 people,
• a wholesale and distribution company of about 50 people,
• a care company of about 300 people.

The list includes small, medium-sized and large organisations from different sectors and continents. The victims have hardly anything in common, except that they all had a vulnerability the attackers were able to exploit.

How can even the smallest company become a target?

It is almost impossible to hide from the downsides of the internet, because you would also have to hide from your own customers and partners. Almost every company has a website, an online shop, a customer portal or a booking system. In addition, cloud tools such as Microsoft 365 or Google Workspace are in use, as well as routers, IoT devices and remote connections.

Every service, tool or device connected to the network is a new touchpoint where criminals can look for vulnerabilities and access to the company's systems.

Technical vulnerabilities are not the only route. A large share of attacks are based on human error, such as falling for phishing. Security awareness in SMEs is on average weaker than in large companies, so human error plays a bigger role.

Attackers are not always satisfied with stealing data. The victim can be used as a stepping stone for more convincing follow-up attacks, for example by sending phishing messages to customers and partners from a hijacked company account.

Is there anything you can do?

Very much so. Getting the basics in order goes a long way:

1. Update operating systems and software as soon as updates are available.
2. Back up important data and test restoring it regularly.
3. Turn on multi-factor authentication whenever possible.
4. Manage access rights to data.
5. Make a plan for security incidents.
6. Increase your staff's security awareness.

Foregon helps SMEs manage their information security systematically and cost-effectively. Get in touch and we will look together at how to minimise the risks caused by cybercriminals.

← All articles