Kaspersky unveils how the worst cyber incidents hit SMBs over the past year

Global survey finds 86% of SMBs experienced at least one cyber incident in the past year, with financial losses and data theft among the main consequences

Kaspersky, a cybersecurity company that provides security software and services for businesses and consumers, surveyed 1,800 IT and IT security professionals across 18 countries to examine the cyber incidents affecting small and medium-sized businesses over the past year. The SMB segment accounted for 616 respondents, including participants from South Africa.

According to a poll of IT and IT security professionals in the SMB sector, an overwhelming 86% of respondents globally and 78% in South Africa stated they had experienced at least one cyber incident in the last year. Among them, the top threats cited as the most damaging were phishing attacks, software and web application exploits, mass malware, ransomware, external remote access and attacks targeting AI vulnerabilities.

Financial loss emerged as one of the leading consequences of the most harmful incident, cited by 22% of respondents globally and 16% in South Africa. Other major impacts affecting companies included: theft of customer data, temporary disruption to client-facing services like websites and online stores, loss of control over IT infrastructure, and general business process disruption.

Respondents indicated that, beyond the immediate financial impact, attackers focused heavily on data theft. The most frequently targeted information included clients’ data (32% globally and 35% in South Africa), sensitive internal information such as financial credentials, legal documents, etc. (28% globally and 23% in South Africa), employees’ credentials (25% globally and 29% in South Africa), and the organisation’s business strategy (23% globally). This pattern reflects a strategic shift toward extracting valuable data that can be monetised or leveraged for further attacks.

The data shows that cybercriminals concentrate their efforts on IT and IT‑security teams, with 50% globally (48% in South Africa) of the most harmful attacks directed at IT and 46% globally (32% in South Africa) at IT‑security departments. Accounting and finance departments were the third most targeted area (24% globally and 26% in South Africa).

On average, globally, three departments were compromised simultaneously during the most severe incidents. Notably, SMBs experience a higher incidence of attacks through customer‑service channels (21%) compared with mid‑market (15%) and large enterprises (17%).

Recent breaches have compelled companies to implement additional cybersecurity measures across processes, people, and technologies. The top priority globally is deploying IT security monitoring solutions (24%), followed by hardening third-party compliance requirements (23%) and upgrading credential management practices (23%). An almost equal of organisations focused on deploying security software across all employee devices and investing in specialised training to boost IT staff expertise (22%). In South Africa, the top priority is the implementation/update of IT security compliance requirements for partners and contractors (32%), followed by the installation/update of IT security solutions on all employees’ corporate/personal devices (29%) and the introduction of multi-factor authentication (29%).

“Cyber incidents often inflict far more devastating consequences on small and medium-sized companies than high-profile breaches do on large corporations. Sometimes, it can threaten the very survival of these resource-constrained businesses”, Ilya Markelov, Head of Unified Platform Product Line at Kaspersky. “Faced with diverse and intense threats, operational constraints, and specific growth objectives, SMBs urgently need scalable, purpose-built protection. Kaspersky Optimum, our flagship offering for this segment, is engineered to bring expert and flexible security within reach for growing businesses. With the new suite of customisable, add-on Security Modules, users can further extend capabilities of its core products and strengthen defences as new needs or challenges evolve.

To minimise the risk of losses caused by cyber incidents, Kaspersky recommends that small and medium-sized businesses consider the following:

Implement specialised solutions that fit budget, size, and industry requirements to protect against advanced attacks : Kaspersky Small Office Security Premium is an easy-to-use solution that ensures endpoint protection against advanced threats, including malware, ransomware and provides access to security awareness training for employees, making it ideal for micro-businesses. Small and medium-sized businesses that need more advanced security capabilities to counter diverse threats should consider Kaspersky Optimum . The offering provides core protection to help prevent evolving attacks, detect threats early, investigate incidents and respond before they escalate into more serious business consequences.

Implement specialised solutions that fit budget, size, and industry requirements to protect against advanced attacks : Kaspersky Small Office Security Premium is an easy-to-use solution that ensures endpoint protection against advanced threats, including malware, ransomware and provides access to security awareness training for employees, making it ideal for micro-businesses. Small and medium-sized businesses that need more advanced security capabilities to counter diverse threats should consider Kaspersky Optimum . The offering provides core protection to help prevent evolving attacks, detect threats early, investigate incidents and respond before they escalate into more serious business consequences.

Integrate daily backup routines into operations to secure critical information against emergencies and ransomware.

Integrate daily backup routines into operations to secure critical information against emergencies and ransomware.

Establish internal processes: Implement strict access controls for corporate resources and cloud services, ensuring IT promptly revokes permissions during employee offboarding.

Establish internal processes: Implement strict access controls for corporate resources and cloud services, ensuring IT promptly revokes permissions during employee offboarding.

Manage human risk: Support technical controls with continuous training on safe browsing and password hygiene, while requiring IT approval for all new software. Help your employees build sustainable cyber habits with the Kaspersky Automated Security Awareness Platform providing interactive online courses and simulated phishing campaigns.

Manage human risk: Support technical controls with continuous training on safe browsing and password hygiene, while requiring IT approval for all new software. Help your employees build sustainable cyber habits with the Kaspersky Automated Security Awareness Platform providing interactive online courses and simulated phishing campaigns.

*1800 interviews were conducted globally with representation across 18 countries: Brazil, Mexico, Colombia, France, Germany, Italy, Spain, Russia, India, Indonesia, Malaysia, China, Thailand, Vietnam, Egypt, South Africa, Saudi Arabia, Turkey. Among the total sample, the SMB sector was represented by 616 respondents.

Portal ERP's editorial team brings the latest news and analysis on technology and business management.

NetScout updates DDoS protection software to suppress outbound botnet traffic

The expanded Adaptive DDoS Protection system identifies malicious data originating from compromised internet of things devices before the traffic leaves a service provider network

South African enterprises penalize staff for cybersecurity errors

A new data analysis indicates that half of surveyed organizations issue formal warnings or disciplinary actions to employees who make inadvertent mistakes

78% of South African SMBs suffered cyberattacks in the past year, Kaspersky reports

Social engineering and outdated software emerged as the primary security vulnerabilities for growing businesses across the region