Kaspersky unveils how the worst cyber incidents hit SMBs over the past 12 months

As small and medium-sized businesses increasingly become a battleground for digital threat actors, understanding the true operational and financial impact of security breaches has never been more critical. A new global survey[1] by Kaspersky draws attention to the key security gaps of companies below 500 employees and highlights critical risk areas.

According to a poll of IT and IT security professionals in the SMB sector, an overwhelming 86% of respondents stated they had experienced at least one cyber incident in the last year. Among them, the top threats cited as the most damaging were phishing attacks, software exploits, mass malware, ransomware, and attacks targeting AI vulnerabilities.

Specifically, financial loss emerged as the leading consequence of the most harmful incident, cited by 22% of respondents. Other major impacts followed closely, each affecting nearly one-fifth of companies: theft of customer data, temporary disruption to client-facing services like websites and online stores, loss of control over IT infrastructure, and general business process disruption.

The survey also highlights the irreversible nature of some of the damage: 16% of companies reported irrecoverable data loss, while 13% suffered irreversible damage to corporate assets. This underscores the long‑term risks that cyber incidents pose to SMBs.

Global Kaspersky B2B Market Pulse survey: What was the result of the most harmful incident your organization experienced over the past 12 months? (Multiple choice)

Adversaries’ Primary Objectives

Respondents indicated that, beyond the immediate financial impact, attackers focused heavily on data theft. The most frequently targeted information included clients’ data (32%), sensitive internal information such as financial credentials, legal documents, etc (28%), employees’ credentials (25%), and the organization’s business strategy (23%). This pattern reflects a strategic shift toward extracting valuable data that can be monetized or leveraged for further attacks.

Most Targeted Departments

The data shows that cybercriminals concentrate their efforts on IT and IT‑security teams, with 50% of the most harmful attacks directed at IT and 46% at IT‑security departments. Accounting and finance departments were the third most targeted area (24%). On average, three departments were compromised simultaneously during the most severe incidents. Notably, SMBs experience a higher incidence of attacks through customer‑service channels (21%) compared with mid‑market (15%) and large enterprises (17%).

Actions taken

Recent breaches have compelled companies to implement additional cybersecurity measures across processes, people, and technologies. The top priority is deploying IT security monitoring solutions (24%), followed by hardening third-party compliance requirements (23%) and upgrading credential management practices (23%). An almost equal share of organizations focused on deploying security software across all employee devices and investing in specialized training to boost IT staff expertise (22%).

“Cyber incidents often inflict far more devastating consequences on small and medium-sized companies than high-profile breaches do on large corporations. Sometimes, it can threaten the very survival of these resource-constrained businesses”, comments Ilya Markelov, Head of Unified Platform Product Line at Kaspersky. “Faced with diverse and intense threats, operational constraints, and specific growth objectives, SMBs urgently need scalable, purpose-built protection. Kaspersky Next Optimum, our flagship offering for this segment, is engineered to bring expert and flexible security within reach for growing businesses. With the new suite of customizable, add-on Security Modules, users can further extend capabilities of its core products and strengthen defenses as new needs or challenges evolve.

To minimize the risk of losses caused by cyber incidents, Kaspersky recommends that small and medium-sized businesses implement specialized solutions that fit budget, size, and industry requirements to protect against advanced attacks:

• Small and medium-sized businesses that need more advanced security capabilities to counter diverse threats should consider Kaspersky Next Optimum. The offering provides core protection to help prevent evolving attacks, detect threats early, investigate incidents and respond before they escalate into more serious business consequences. With new Security Modules, businesses can extend this protection to address such specific risks, as email-borne threats, workload and cloud security risks, and vulnerabilities. Security Modules include Security Awareness, Email Security, Workload Security, Threat Lookup & Analysis and Vulnerability Management, allowing businesses to strengthen specific areas without redesigning their existing security stack.  
• Kaspersky Small Office Security Premium is an easy-to-use solution that ensures endpoint protection against advanced threats, including malware, ransomware and provides access to security awareness training for employees, making it ideal for micro-businesses. 
• Establish internal processes: Implement strict access controls for corporate resources and cloud services, ensuring IT promptly revokes permissions during employee offboarding.
• Secure your data: Integrate daily backup routines into operations to secure critical information against emergencies and ransomware.
• Manage human risk: Support technical controls with continuous training on safe browsing and password hygiene, while requiring IT approval for all new software. Help your employees build sustainable cyber habits with the Kaspersky Automated Security Awareness Platform providing interactive online courses and simulated phishing campaigns.