"We're too small to be hacked": what attackers want from a five-person business

It's the most common thing we hear: "Who would bother with us? We're five people. We don't have anything worth stealing."

It's an understandable thought, and it's wrong for a simple reason. Most attacks on small businesses aren't aimed at you. They're aimed at everyone, and you're one of the businesses that didn't lock the door.

Attacks are automated, and they don't check your size

Criminals don't pick a business, research it and break in. They run tools that try stolen passwords against thousands of email accounts, scan the internet for computers missing an update, and send the same convincing email to every address on a list. Whoever opens the door gets attention.

Being small doesn't hide you. It usually just means fewer protections.

What the 2026 numbers say

Verizon's annual breach report is the largest public study of real breaches. Its 2026 edition found:

• Ransomware was part of 48% of all breaches, up from 44% the year before, and "small organizations are disproportionally impacted by ransomware."
• Among the small and mid-sized business breaches it studied, the attackers were outsiders every time, and the motive was money every time.
• Exploiting software flaws is now how 31% of breaches start, up 55% in a year.

(Verizon 2026 DBIR executive summary; Verizon 2026 SMB summary)

And the FBI's 2025 crime report counted about $3 billion lost to email payment fraud, across 24,768 complaints, which works out to about $123,000 each (FBI Internet Crime Report, 2025). Those are businesses like yours, paying invoices to the wrong account.

What they actually want from you

You may not have secrets. You almost certainly have these:

What you have	What they do with it
Money moving in and out	Fake invoices, changed bank details, redirected payroll
An email account your customers trust	Send scams to your customers, in your name
Files you can't work without	Lock them with ransomware and charge you to unlock them
Customers' personal details	Sell them, or use them for identity fraud
A computer and an internet connection	Use it to attack someone else
A bank login, a card on file, an ad account	Spend your money directly

Notice that none of these require you to be big. They require you to be open for business.

Why small businesses are easier

Not because owners are careless. Because security is nobody's job:

• No one is watching at 2 AM, or on a Saturday, when most attacks get going.
• The same password has been used for years, on several accounts.
• Updates wait until someone has time.
• Former employees still have logins.
• Payments get approved on trust, because everyone knows everyone.

What makes you a bad target

The good news: because the attacks are automated, they move on quickly when the door is locked. A small business with these in place is far less likely to be the one that gets through:

1. Two-step sign-in on every email account. See multi-factor authentication explained.
2. Automatic updates on every computer and phone.
3. Real protection on every computer, with someone watching it. See antivirus vs EDR.
4. Backups kept separate, and tested.
5. A call-back rule for any payment change. See the free payment change verification procedure.
6. Accounts removed the day someone leaves.

For the full version, see cybersecurity for a small business with no IT person.

What it costs, against what's at stake

	What it comes to
Our Essentials plan for five people	$495 a month. Help desk, updates, backups and a 24/7 security team on every computer.
Our Business plan for five people	$870 a month. Adds email security, staff training and account monitoring.
One email payment fraud	About $123,000 on average
A week locked out by ransomware	A week of revenue, plus the cost of rebuilding, plus the customers who went elsewhere
In the worst cases	Verizon found that in the costliest 2.5% of breaches at small and mid-sized businesses, the loss was more than 7% of annual revenue

Being small isn't a defense. Being a little harder to break into than the business next door is. Book a free Security Check and we'll tell you which side of that line you're on.