Small businesses are told they are both too small to target and doomed to close after one attack, and neither claim survives contact with the official data. This page collects the small and medium-sized enterprise (SME) figures that come from primary sources: the UK government's Cyber Security Breaches Survey, the Verizon Data Breach Investigations Report (DBIR), the FBI Internet Crime Complaint Center (IC3) and ENISA, the EU cybersecurity agency. Every figure carries the source, the publisher and the year, and we explain where a popular number could not be traced. It is written for owners, managers, IT providers and advisers who need honest numbers to set priorities. For what to do next, see the Small Business Cybersecurity Basics Guide. Last reviewed: November 2026.
Key takeaways
- Two in five small firms see attacks every year. The UK Cyber Security Breaches Survey 2025/2026 found 42% of micro businesses and 46% of small businesses identified a breach or attack in the previous 12 months.
- Phishing dominates. The same survey found phishing affected 38% of businesses, while ransomware was reported by 1%.
- Most incidents are cheap, a few are not. The median perceived cost of the most disruptive incident was £0 for UK businesses, but the 95th percentile for micro and small businesses was £4,000.
- Suppliers are the SME weak point. The Verizon DBIR 2026 records third-party involvement in 55% of SMB breaches, against 48% across all organisations.
- The "60% close within six months" claim is untraceable. We could not find a primary study behind it; the nearest real figure is a self-reported expectation from a 249-company ENISA survey.
How often small businesses are attacked
The UK Cyber Security Breaches Survey is the most useful SME source because it reports results by size band and uses a random sample of businesses, not only victims. The 2025/2026 edition was published on 30 April 2026, with fieldwork from August to December 2025 and 2,112 businesses interviewed. See the UK Cyber Security Breaches Survey page for the full survey.
| Measure (UK, 2025/2026) | Micro (1 to 9 staff) | Small (10 to 49) | Medium (50 to 249) | Large (250+) | All businesses |
|---|---|---|---|---|---|
| Identified any breach or attack in last 12 months | 42% | 46% | 65% | 69% | 43% |
| Victim of at least one cyber crime | 17% | 24% | 41% | 48% | 19% |
| Board member or trustee responsible for cyber security | 29% | 37% | 52% | 68% | 31% |
| Reviewed immediate suppliers' cyber risks | 12% | 22% | 30% | 48% | 15% |
- Scale: the survey estimates that the 19% of businesses that were victims of cyber crime equals approximately 267,000 UK businesses.
- Size gradient: larger firms report more incidents, which is likely to reflect both more staff and systems exposed and better monitoring to notice attacks. Lower figures for micro businesses should not be read as lower risk.
What attacks small businesses face
| Finding | Figure | Source and year |
|---|---|---|
| Businesses experiencing phishing | 38% | UK Cyber Security Breaches Survey 2025/2026 |
| Businesses experiencing impersonation of the organisation | 12% | UK Cyber Security Breaches Survey 2025/2026 |
| Businesses reporting ransomware | 1% (3% in 2024/2025 and 2023/2024) | UK Cyber Security Breaches Survey 2025/2026 |
| Breached organisations naming phishing as the most disruptive attack | 69% | UK Cyber Security Breaches Survey 2025/2026 |
| Patterns behind SMB breaches | System Intrusion, Basic Web Application Attacks and Social Engineering make up 100% | Verizon DBIR 2026 |
| SMB breaches with a human element | 45% | Verizon DBIR 2026 |
| SMB breaches with credential abuse as the entry point | 13% | Verizon DBIR 2026 |
The Verizon DBIR 2026 SMB section covers 7,256 incidents, 7,152 with confirmed data disclosure, out of a dataset of more than 31,000 incidents. It states that small organisations are disproportionately affected by ransomware, and ransomware featured in 48% of all breaches in the dataset. The low UK ransomware share and the high DBIR share measure different things: the UK figure is the share of all businesses, the DBIR figure is the share of confirmed breaches investigated. See the Verizon DBIR page and the Top 10 Small Business Cyber Threats.
What incidents cost small businesses
- Typical cost: the UK survey found the median perceived cost of the most disruptive breach or attack was £0 for businesses and £30 for medium and large businesses. Most incidents are blocked phishing emails or short disruptions with no direct spend.
- The tail: the 95th percentile was £4,000 across all businesses and micro and small businesses, and £10,000 for medium and large businesses. One in twenty incidents costs more than this, and some cost far more.
- Fraud losses: the FBI IC3 2025 report recorded 24,768 business email compromise (BEC) complaints with losses of USD 3.05 billion, from 1,008,597 complaints and USD 20.877 billion in total losses. IC3 does not split these by business size, but BEC targets the payment processes that small firms often run with one person and no second check.
- Ransom amounts: the Verizon DBIR 2026 gives a median ransom payment of USD 139,875 across its dataset, and 69% of ransomware victims did not pay. There is no SMB-specific median.
- Why not IBM: the IBM Cost of a Data Breach Report studies about 600 breached organisations with breaches of roughly 3,000 to 114,000 records (2025 edition). Its USD 4.44 million (2025) and USD 4.99 million (2026) averages describe that population, not a ten-person firm. See the IBM Cost of a Data Breach Report page.
The "60 percent close within six months" myth
A claim that 60% of small businesses close within six months of a cyber attack appears in many articles and sales decks. We looked for the study behind it and could not trace it to any published primary research with a method, a sample and a date. Treat it as unsupported.
- The nearest real figure: ENISA's 2021 report on cybersecurity for SMEs surveyed 249 SMEs in 25 EU member states. Over 80% said a cybersecurity issue would have a serious negative impact on their business within a week, and the report gives 57% for those who said they would most likely go bankrupt or out of business. That is an expectation reported by respondents, not a count of firms that closed, and the report does not state the base of the 57% clearly.
- What the UK data shows: with a median incident cost of £0 and a 95th percentile of £4,000, most UK small businesses that are attacked carry on trading. A small number suffer severe losses, especially from payment fraud and ransomware, and that tail is the real risk to plan for.
- Why it matters: fear-based numbers lead to over-buying products and under-investing in basics such as multi-factor authentication, backups and payment checks.
Controls small businesses actually have
| Control or practice | Micro | Small | All businesses | Source |
|---|---|---|---|---|
| Two-factor authentication required | 43% (35% in 2024/2025) | See full report | 47% | UK CSBS 2025/2026 |
| Formal incident response plan | 21% | See full report | See full report | UK CSBS 2025/2026 |
| Cyber risk assessment in last 12 months | See full report | 41% | 30% | UK CSBS 2025/2026 |
| Aware of Cyber Essentials (prompted) | 14% | 25% | 17% | UK CSBS 2025/2026 |
| Hold Cyber Essentials | See full report | 12% | 5% | UK CSBS 2025/2026 |
| Specific cyber insurance policy | 8% | 15% | 10% | UK CSBS 2025/2026 |
| Cyber cover within a wider insurance policy | 37% | 40% | 37% | UK CSBS 2025/2026 |
Across all UK businesses, 81% report up-to-date malware protection and 74% back up data in the cloud (2025/2026). The ENISA 2021 survey found 28% of SMEs had assigned an information security officer role, and that over 90% of SMEs that adopted new technology during the pandemic added no new security measures for it. See the Cyber Essentials Guide for the UK baseline scheme.
Suppliers, IT providers and MSPs
- Third parties in breaches: the Verizon DBIR 2026 records third-party involvement in 55% of SMB breaches, above the 48% across all breaches.
- Few firms check: only 12% of UK micro businesses and 22% of small businesses reviewed the cyber risks posed by their immediate suppliers (UK CSBS 2025/2026).
- Delegated admin access: an IT provider with standing administrator rights across many small clients is a single point of compromise. Ask how the provider protects those accounts, whether access uses individual named logins with multi-factor authentication, and how quickly it can be cut off. See Choosing an IT Support Provider or MSP Securely.
Which source answers which question
Most confusion about small business statistics comes from mixing sources that measure different populations. Use this table to pick the right one.
| Source | Population | Best for | Do not use it for |
|---|---|---|---|
| UK Cyber Security Breaches Survey 2025/2026 (DSIT) | Random sample of 2,112 UK businesses, by size band | How common attacks are, typical costs, control uptake | Large-breach costs or non-UK prevalence |
| Verizon DBIR 2026 | More than 22,000 confirmed breaches from Verizon and contributors, with an SMB section | How breaches happen: patterns, third parties, human element | How likely a business is to be attacked |
| FBI IC3 2025 Internet Crime Report | 1,008,597 complaints made to the FBI | Fraud types and reported losses, especially BEC | Business size splits or unreported crime |
| ENISA Cybersecurity for SMEs (2021) | 249 SMEs in 25 EU member states | SME attitudes and readiness during the pandemic | Current rates or closure counts |
| IBM Cost of a Data Breach (2025, 2026) | About 600 breached organisations | Enterprise breach cost drivers | Small business costs |
A fair sentence for a small business board pack names the source, its year and its base, for example: "42% of UK micro businesses identified a breach or attack in the last 12 months (DSIT Cyber Security Breaches Survey 2025/2026)."
What the numbers mean for defenders
| Finding | Priority control | NIST CSF 2.0 |
|---|---|---|
| Phishing hits 38% of businesses; 43% of micro firms require two-factor authentication | Phishing-resistant or app-based MFA on email, banking and admin accounts | PR.AA-03 |
| BEC losses of USD 3.05 billion (IC3 2025) | Call-back verification for any change of bank details or urgent payment | PR.AT-01 |
| Ransomware is disproportionate in small organisations (DBIR 2026) | Offline or immutable backups, tested restores | PR.DS-11, RC.RP-03 |
| Third parties in 55% of SMB breaches | Supplier and IT provider access review | GV.SC-07 |
| 21% of micro firms have an incident response plan | One-page plan with contacts, bank and insurer numbers | RS.MA-01 |
For the plan itself, see the Small Business Incident Response Guide and the Small Business Cyber Security Checklist.
Practitioner checklist
- Quote small business figures from size-banded sources (UK CSBS, DBIR SMB section), not enterprise cost studies.
- State the edition, publisher and base (all businesses or breached organisations) with every figure.
- Drop the "60% close" claim from training and proposals unless a primary source is produced.
- Turn on multi-factor authentication for email, banking, cloud admin and remote access first.
- Introduce a call-back rule for payment and bank detail changes.
- Keep at least one backup copy offline or immutable and test a restore each quarter.
- Review what your IT provider and key suppliers can access, and remove standing admin rights you do not need.
- Write a one-page incident plan and check whether your insurance actually covers cyber incidents.
Standards and references
- DSIT: Cyber Security Breaches Survey 2025/2026
- Verizon: 2026 Data Breach Investigations Report Executive Summary
- FBI IC3: 2025 Internet Crime Report
- ENISA: Cybersecurity for SMEs, Challenges and Recommendations
- IBM: Cost of a Data Breach Report 2025
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Small Business Cybersecurity Basics Guide · UK Cyber Security Breaches Survey · FBI IC3 Internet Crime Report · Ransomware Basics for Small Businesses Guide · Data Breach Statistics Guide