Small Business Cybersecurity Statistics 2026: Losses, Ransomware and Vendor Risk

Reported losses rose every year from 2021 to 2025, reaching $20.877 billion. Many victims never file a complaint, so treat these as a floor, not the full picture.

Business email compromise was the second-largest loss category at $3.05 billion. It is the one built to target companies: a spoofed vendor or boss asks for a wire, and someone sends it.

BEC losses dipped to $2.77 billion in 2024, then climbed back to $3.05 billion in 2025. This scam is not going away.

Ransomware complaints rose from 2,825 in 2023 to 3,611 in 2025. Reported dollar losses stay small because they usually leave out downtime, lost work and cleanup costs.

Law firms (18%) and contractors (17%) topped the list outside critical infrastructure. These are often small, busy offices holding client files and approving payments all day.

IC3 complaints and reported losses for business-relevant crime types, 2023 to 2025

Source: Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), 2025 IC3 Annual Report (Internet Crime Report). Download as image

Verizon 2026 DBIR and Breach Impact Study findings highlighted for SMBs

Source: Verizon Business, Cybersecurity insights for SMBs (2026 DBIR and 2026 Breach Impact Study infographic). Download as image

How often are small businesses hit by cyberattacks?

No single federal count tracks attacks on small businesses alone. What you get instead is complaint data, and it points one way. The FBI's IC3 logged 191,561 phishing and spoofing complaints in 2025, 24,768 business email compromise complaints, and 3,611 ransomware complaints.

Those are reports, not attacks. Plenty of owners clean up quietly, eat the loss and never file. So the real numbers are higher, and the trend lines matter more than any single figure. Ransomware complaints rose each year from 2023 to 2025. Reported phishing losses went from $70,013,036 in 2024 to $215,843,126 in 2025.

If you run a small agency or a contracting firm, assume someone will try. The question is whether one click turns into a wire transfer or a locked server. Most of these losses start with an ordinary task, like paying an invoice or opening a shared file, done in a hurry by someone who trusted the sender.

What does a data breach cost a small business?

IBM puts the global average cost of a data breach at $4.99 million in its 2026 report. That average leans on large companies, so don't read it as your number. A more useful view for small firms comes from Verizon's 2026 Breach Impact Study, built on cyber insurance claims: in extreme cases, a breach took more than 7% of a small business's revenue.

Think about what that share of revenue means for a firm with thin margins. It can erase most of a year's profit in a single event. And that is before the slower costs: clients who leave, a cyber policy that costs more at renewal, and weeks of staff time spent on notices, forensics and cleanup. Every state has a breach notification law that can require you to tell affected customers, which brings mailing costs, call center work and sometimes credit monitoring.

Reported ransomware losses to the FBI were $32,320,105 in 2025, which looks small. The FBI notes that figure usually excludes lost business, wages, files, equipment and repair costs. For most small shops, the downtime is the real bill.

Your contracts shape this bill more than most owners realize. If the breach happened at a vendor, the question of who pays for those notices and lost days comes down to the liability and indemnity clauses you signed. If you hold client data under a services agreement, your own contract may promise security you can't back up.

Why is business email compromise the biggest threat to small firms?

BEC losses hit $3.05 billion in 2025, second only to investment fraud. The scam is simple. Someone breaks into or spoofs a vendor's email, then sends your bookkeeper new bank details for an invoice that looks normal. Or a fake message from the owner asks for an urgent wire before the weekend.

Small businesses are a good target because the person who reads the email is often the person who pays it. There's no second approver, and the vendor relationship is informal enough that a sudden change of bank details doesn't raise eyebrows.

The fix is mostly process, not software:

A real example of how it plays out: a small plumbing firm's supplier gets its email hacked. The attacker replies inside an existing thread about a spring order, attaches a real-looking invoice and mentions the supplier switched banks. The owner pays. The supplier still wants its money. Without a written rule about payment changes, both sides argue over who carries the loss.

• Confirm any change in payment details by phone, using a number you already had, never one from the email.
• Require two people to approve wires above a set amount.
• Turn on multi-factor authentication for every email account, including the owner's.
• Put the payment-change procedure in writing with your key vendors and clients.

Are your vendors your biggest cyber risk?

For many small businesses, yes. Verizon's 2026 DBIR found 48% of breaches involved a third party, up 60% from the year before. That covers your SaaS tools, your IT contractor, your payment processor and anyone else with access to your systems or data.

Patching is part of it. Vulnerability exploitation was the way in for 31% of breaches, and the median time to fully fix a critical flaw was 43 days. If your vendor is that slow, your customer data sits exposed for all of those 43 days, and you probably won't hear about it until much later.

You can't audit every vendor. You can read what they promise. Many small business software contracts cap the vendor's liability at a small slice of fees, leave out any duty to tell you quickly about a breach, and say nothing about who pays for customer notices. That is where the money question gets answered, long before an incident.

When you renew a tool, ask for three things in writing: a breach notice deadline, a security standard the vendor must keep, and a higher liability cap for data incidents. Plenty of vendors have a security addendum ready. They just don't offer it unless you ask.

Which small businesses are most at risk?

Among ransomware complaints from businesses outside critical infrastructure, legal services made up 18% and contracting services 17%. Engineering and architecture firms followed at 10%, then consulting at 7%. What these businesses share: sensitive client files, frequent payments to and from third parties, and lean IT.

Phones are a growing gap too. Verizon found the median click rate on mobile phishing runs 40% higher than on email. Staff who approve invoices or reset passwords from their phones are the people attackers want.

Size alone doesn't protect you. Attackers use automated tools that scan for the same unpatched software in a dental office as in a bank. Smaller firms just have fewer people watching, so an intrusion can run for weeks before anyone notices.

What to do this quarter

• List every vendor that touches your data or money, and note what each contract says about breaches and liability.
• Set up a call-back rule for any change in bank details, from vendors or clients.
• Turn on multi-factor authentication for email, banking and cloud storage.
• Ask your IT provider how fast they patch critical flaws, and get the answer in writing.
• Check whether your cyber insurance requires specific controls, and whether you meet them.
• Keep offline or separate backups and test a restore at least once.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. Figures that could not be confirmed were left out.

1. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), 2025 IC3 Annual Report (Internet Crime Report) (2025 edition (calendar year 2025 data))
2. Verizon Business, Cybersecurity insights for SMBs (2026 DBIR and 2026 Breach Impact Study infographic) (2026 DBIR dated May 19, 2026; 2026 Breach Impact Study dated Jun 16, 2026)
3. IBM, Cost of a Data Breach Report 2026 (2026 edition)