Cyberattacks on Small and Medium‑Sized Enterprises: Key Findings from Kaspersky Study A global study conducted by cybersecurity firm Kaspersky has revealed that cyber incidents are increasingly common among companies with fewer than 500 employees. According to the survey, 86 % of small and medium‑sized enterprises (SMEs) reported experiencing at least one cyber incident in the past 12 months. The same percentage of IT and security professionals within those firms confirmed that their organizations had faced a cyber event during the same period. Most Common Threats Respondents identified the following as the most severe threats: 1. Phishing attacks 2. Exploitation of software vulnerabilities 3. Mass malware distribution 4. Ransomware 5. Attacks targeting artificial‑intelligence‑related vulnerabilities Impact on Businesses Financial loss was cited as the primary consequence of the most serious incidents, with 22 % of respondents indicating it as a major effect. Other impacts—reported by nearly one‑fifth of companies—included: Theft of customer data Temporary disruption of services such as websites and online stores Loss of control over IT infrastructure Disruption of business processes In some cases, affected data and assets could not be recovered. Sixteen percent of companies reported irrecoverable data loss, while 13 % experienced irreversible damage to company assets. Targets of Attacks Customer data was the most frequently targeted information, identified by 32 % of respondents. Other high‑value targets were: Internal sensitive information (28 %) Employee authentication data (25 %) Business strategy documents (23 %) Departments Most Affected The IT and security departments were most often compromised. In 50 % of incidents, the IT department was affected, and in 46 % the security function was targeted. Accounting and finance departments were impacted in 24 % of cases. On average, the most serious incidents involved three departments simultaneously. Channel of Attack Among SMEs, 21 % of respondents reported attacks that entered through customer‑service channels. The percentages were 15 % for medium‑sized firms and 17 % for larger companies. Post‑Incident Measures After experiencing security incidents, companies adopted a range of new safeguards: 24 % implemented IT security monitoring solutions 23 % tightened third‑party compliance requirements 23 % improved authentication data management practices 22 % invested in security software for employee devices A similar proportion invested in specialized IT staff training Recommendations for SMEs Kaspersky’s analysis suggests several best practices to reduce the risk of future incidents: Establish clear procedures for granting and revoking internal resource and cloud service access, especially for employees who leave the organization. Perform regular backups of critical data to enable recovery from ransomware or other data‑loss events. Provide ongoing employee training on safe internet use, password management, and software installation. Conduct phishing simulations and security awareness courses to reinforce protective behaviors. The study underscores the growing threat landscape for SMEs and highlights the importance of proactive security measures to protect customer data, maintain operational continuity, and safeguard financial assets.
Article source: Adev&acaron;rul | Image credit: Adev&acaron;rul