Why small businesses are frequent targets for cyber attacks
Twenty-seven percent of small business owners rank a cyberattack or data breach among their top concerns, according to an ERGO NEXT 2026 survey of 501 small business owners. And about a third of those surveyed — 31% — said it was the risk they felt least prepared to handle. And the Identity Theft Resource Center found that 63% of breached small businesses suffered losses of $250,000 or more, causing many to raise prices to cover the cost.
Some small business owners think they’re too small to attract the attention of cyber criminals. But their small size is precisely what makes them an attractive target, says Shawn Silver, Founder and CEO of payment processing company Payment Nerds. He has a front-row seat to the risks small businesses regularly face from hackers.
“Cybercriminals aren’t looking for the biggest company,” he says. “They’re looking for a way in, and a small business can be perfect.” A compromised login could open the door for a hacker to gain unauthorized access to client data and financial information, putting a business at serious risk.
Which industries could benefit from Cyber Liability insurance most?
The businesses most likely to face cyber risk are those in high-risk industries, such as financial services, and, “Any company that processes digital payments or handles customer data has exposure,” Silver says.
These industries can include:
Your business might benefit from cyber liability insurance if you:
- Collect sensitive client information such as birth dates, Social Security numbers or bank account information
- Accept credit card payments or use a POS system
- Send and receive invoices and payments by email or wire
- Regularly log in to client systems or accounts
- Rely on cloud software or email for daily operations
- Are required by clients or contracts to carry this type of business insurance coverage
“We tend to see businesses across e-commerce, subscription models, healthcare and telemedicine, professional services, and other large-scale digital transactions as highly targeted,” Silver reports.
Quick guide: Who needs Cyber Liability insurance most?**
| Industry | Top cyber threat | How cyber liability coverage could help |
|---|
| Consultants/professional services | Account takeover, client data exposure | Coverage for the costs of breach response and legal defense |
| Accountants/financial professionals | Phishing scams, data theft | Notification services, credit monitoring costs and regulatory costs |
| Real estate agents and brokers | Wire fraud, BEC fraud | Legal defense fees, investigation costs |
| Creative services | Compromised confidential client accounts | The costs of third-party claims and response costs |
| Retail, online retail, and restaurants | POS malware, ransomware | The loss of income from business interruption, data breach costs |
Top cyber threats by industry
The cyber risks a business might face depend on size, industry, and many other factors. But as technology evolves, so do black-hat tactics.
“Small businesses are starting to deal with the consequences of phishing and stolen credentials, account takeover, ransomware, payment fraud, and compromised customer data,” Silver says.
Here’s what those risks can look like in real life.
1. Consultants: Costly client data exposure
Consultants trade and rely on information to provide results for their clients. Email inboxes and shared drives can hold a trove of valuable data, such as strategy documents and client financials. This turns your email account into a valuable key that can unlock data for cyber criminals.
Business email compromise (BEC) is when a criminal hacks an email account to access data or redirect funds. BEC caused about $3 billion in reported losses in 2025, according to the FBI’s Internet Crime Report.
Many consultants carry professional liability insurance, also called errors and omissions (E&O) insurance, to help protect against claims that their professional errors or mistakes cost their client money. But data breaches are a different kind of risk. Consultants can add cyber liability insurance to their professional liability policy to help cover costs that arise from a breach.
2. Financial professionals: Hacked financial data
Accountants, bookkeepers, brokers, advisors and tax professionals have access to extremely valuable data: Personal identity and financial information.
As a financial professional, documents containing client data such as SSNs, IRS identifiers or bank account numbers regularly pass through your inbox. A breach at your business could lead to client notification costs, credit monitoring services or regulatory penalties. Cyber liability insurance could help cover those expenses after a covered event.
3. Real estate agents: Wire fraud for large sums
As a real estate agent or broker, you regularly transact deals involving steep amounts of money, often transferred from one party to another via wire. Contracts often have tight deadlines and rapid turnarounds, with many different parties on an email thread.
Criminals know this, too. Which is why they often target real estate firms and title companies. It’s not uncommon for them to spoof an email and divert funds using fraudulent wiring instructions.
The FBI received more than 12,000 complaints of real estate fraud in 2025, with more than $275 million in reported losses.
4. Creative services: Compromised client accounts
Marketing agencies, designers, IT consultants and software developers, copywriters and other professionals often hold sensitive client login information. Cyber criminals target creatives and agencies through phishing, social engineering and other tactics to try to gain access to this information — which is exactly what happened to Tricia Mirchandani, founder of the marketing firm T Collective, based in Virginia.
A prospective “client” made contact and invited her to a Zoom meeting to discuss potential marketing work.
“[It] didn’t look right, but I clicked anyway,” she says. A teammate she had invited to the meeting also clicked. But instead of connecting her to a Zoom meeting, the link attempted to download malware to her computer, likely part of a scheme to access clients’ sensitive business data.
“Fortunately, the scam only worked on PCs, and we both have Macs, so no long-term damage was done,” Mirchandani says. Now the team has a firm rule: “We now never click until we fully verify where the link is coming from,” Mirchandani says.
5. Retailers and restaurants: POS malware
For many small business owners that sell direct to customers, most or all of their revenue runs through a POS system. Cyber criminals install malware onto a POS to steal customer credit card data, or ransomware to lock the system a business needs to operate.
Verizon’s 2026 Data Breach Investigations Report found that ransomware appeared in 48% of all breaches it analyzed — up from 44% the previous year.
“Any downtime or loss of a payment channel for a small business can create immediate cash flow issues,” Silver says.
4 ways small businesses can fight back against cyber criminals
You don’t need an IT department to increase cyber security at your business.
- Use secure payment hardware and software. Store as little payment data as possible and follow PCI standards, which are security rules set by the payment card industry.
- Lock down your logins with multi-factor authentication (MFA). MFA requires a second step, such as a code sent to your phone, every time you log in to your account. Zackery Nienaber, owner of Ohio-based Nienaber and Sons Lawn Care, added MFA to his accounts when he noticed numerous phishing attempts and suspicious login alerts on his business accounts. “Dealing with suspicious login attempts and spoofed messages aimed at our client data made us realize how quickly a localized operation can be disrupted if your digital defenses aren’t locked down,” he says.
- Verify before you pay (or click): Confirm payments such as large wire transfers with a phone call to a number you already have, not one listed in an email. Do the same legwork for any unexpected links or “urgent” requests, even if they look fine at first.
- Train your team: Sometimes all it takes is one careless moment to bring down your whole company. “Businesses can have the best tools in the world, but if an employee is tricked into giving up their access, the entire system is compromised,” Silver says. Provide regular team hacker training and refreshers on the latest scams so everyone knows how to spot red flags.
“Cybersecurity should be thought of as a business function, not a one-time project,” Silver says. “Employees and vendors come and go, software is updated and your revenue streams evolve.” Your security practices should evolve, too.
He recommends regularly reviewing answers to these three questions:
- Who has access to my systems?
- What sensitive data do I store?
- What happens to my business if my payment systems are shut off?
“Small businesses dedicate a lot of time and energy to generating revenue,” he says. “They need to dedicate the same level of investment to protecting that revenue stream.”
What Cyber Liability insurance could cover
One of the best ways to protect your revenue stream against the cost of a cyberattack is with cyber liability insurance. Depending on your policy, this type of small business insurance could help cover costs such as:
- Restoring your data after a ransomware attack
- Legal costs or regulatory penalties associated with a data breach
- Lost business income
For example, if a criminal hacks the email inbox of your management consulting business, they might be able to access a client’s login credentials (and their personal data).** Cyber liability insurance could help cover the cost of an investigation and your legal defense after a covered breach.
