“Nine in 10 small and midsize businesses have been hacked” ... Financial damage and data loss, too

[Financial News] Around nine in 10 IT and security professionals at small and midsize businesses worldwide experienced a cyber incident in the past year, according to the findings. The incidents caused not only financial losses but also harm such as customer data breaches and permanent data loss, making it a priority for these businesses to strengthen their cybersecurity capabilities.
Global cybersecurity company Kaspersky announced on the 20th the findings of a global survey analyzing the impact of cyber incidents on small and midsize businesses and the types of attacks they face.
According to the survey, 86% of IT and IT security professionals at companies with fewer than 500 employees said they had experienced at least one cyber incident in the past 12 months. The main threats included phishing, exploitation of software vulnerabilities, malware, ransomware, and attacks targeting AI vulnerabilities.
Financial loss was the most common impact of cyber incidents, reported by 22%. Customer data theft, online service outages, loss of control over IT infrastructure, and disruption of business processes each affected around 20% of respondent companies. In particular, 16% reported irrecoverable data loss, while 13% experienced irreparable damage to company assets.
Customer data accounted for the largest share of information targeted in attacks, at 32%. Sensitive internal information, such as financial credentials and legal documents, followed at 28%, employee credentials at 25%, and companies’ business strategies at 23%.
By department, IT and IT security were the main targets. IT departments were targeted in 50% of cases, and IT security departments in 46%. Accounting and finance departments also accounted for 24%. On average, three departments were compromised simultaneously in a single incident.
The most common response adopted by companies after an incident was an IT security monitoring solution (24%). Strengthening third-party compliance requirements and improving credential management followed at 23% each. Some 22% of companies also adopted security software for employee devices and invested in specialized training for IT staff.
Lee Hyo-eun, head of Kaspersky South Korea, said, “Attacks targeting small and midsize businesses are no longer limited to making financial demands through ransomware; attackers are also focused on stealing sensitive data belonging to customers and held within companies.”
She added, “Rather than relying on individual security measures, companies should build security frameworks suited to their size and combine technical defenses, access controls, and security awareness training for employees to mitigate the significant risks posed by cyber incidents.”
[email protected] Choi Hye-rim Reporter