The biggest cyber threats to small businesses are phishing, ransomware, wire-transfer fraud (BEC), and data breaches. Most attacks are automated - scanners don’t choose targets by size, they look for a gap: an exposed service, missing MFA, or a spoofable domain. A small practice is a target because small often means easier, not despite its size. Start by seeing what’s exposed to the internet.
This guide takes each threat in turn: what the attack actually looks like, why it works on a business with no IT department, and the single move that cuts the risk fastest. No fear, no jargon - with concrete numbers, including from our own external scans of small dental, accounting, and aesthetic practices.
1. Is my business actually a target?
Yes, though it is almost never about you personally. The overwhelming majority of attacks on small businesses are automated: programs sweep entire ranges of internet addresses and stop wherever they find a gap. The scanner doesn’t ask how many staff you have - it checks whether a port is open, whether a password has leaked, and whether your domain can be spoofed. In that model, being small offers no cover and often makes you the easier mark.
The “we’re too small for anyone to bother with us” assumption is the most expensive belief in small business. According to the Verizon Data Breach Investigations Report, a large share of breaches - around 43% - involve organizations with fewer than 1,000 employees. Attackers run on economics of scale: a thousand weakly defended dental offices is a better business than one well-defended hospital network.
Our own research backs this up bluntly. In external scans we ran on small dental, aesthetic, and accounting practices, not one earned a grade above C, and 83% scored a D or F. These were not businesses singled out as careless - they are a normal cross-section of what we see from the outside, exactly the view an attacker has.
Then there is the value of the data. A patient health record and a complete set of client financial data sell for far more on criminal marketplaces than a stolen credit-card number (IBM X-Force). A dental practice or accounting firm sits on a payload whose value has nothing to do with the size of the business. Health data also drags in HIPAA, which adds public, regulator-driven consequences on top of the breach itself.
2. The threat landscape in numbers (2024-2025)
Reported cybercrime in the US keeps climbing. The FBI’s Internet Crime Complaint Center (IC3) logs record complaint volumes and multi-billion-dollar annual losses year after year, dominated by exactly the categories that hit small businesses hardest: phishing, fraud, and extortion. CISA publishes a steady stream of advisories aimed at the same small-organization weak points - unpatched software, exposed remote access, and weak authentication.
These numbers point to one operating conclusion: you don’t need to be on anyone’s list to get hit. It is enough that your domain or server falls inside a range someone is scanning right now. That is why defense starts with counting your own attack surface - what the business exposes to the outside world.
Our data says the same thing. In those same scans, 94% of the practices were missing even the basic HSTS header that forces an encrypted connection, and in our deeper scans we routinely found services that should never face the internet at all. In other words, before any “sophisticated hacker” shows up, most of the risk comes from things a business exposes by accident and doesn’t know about. The sections below break that down threat by threat.
3. Phishing and social engineering
Phishing is the most common first step in an attack. It is a fake message - email, text, sometimes a phone call - that impersonates a bank, a vendor, the IRS, or a colleague and pushes the recipient to click a link, open an attachment, or enter a password. It works because it targets a person under time pressure, not a system. One link clicked by a front-desk employee is enough to put an attacker inside your email.
Social engineering is especially effective in a small business, where one person answers the email, sends the invoices, and replies to clients. The attacker poses as a trusted brand or as the owner (“please pay this invoice today”) and counts on routine. The closer the message looks to everyday correspondence, the lower the chance anyone stops to question it.
A typical scenario in a practice looks completely ordinary. The front desk gets an email - “Invoice for your domain renewal, due in 24 hours” - with a familiar logo and a link to a login page that mirrors the real one. The person enters credentials under pressure, and the attacker now has the email account or the domain panel. The same method runs under the banner of a shipping carrier, a bank, or Microsoft 365 - only the wrapper changes. That is why training alone isn’t enough; you also need technical controls that catch the mistake before it does damage.
The most important technical defense is often skipped: correct email configuration. Three DNS records - SPF, DKIM, and DMARC - decide whether someone can send mail that impersonates your domain. Our research shows this is a mass failure: 56% of the practices we scanned had no DKIM record, and 50% had no DMARC, or had it set to monitor-only (p=none), which in practice blocks nothing. How to check and fix it, step by step, is in our piece on SPF, DKIM, and DMARC. We take phishing apart - from the attack variants to the three layers of defense - in our guide to phishing.
4. Ransomware
Ransomware locks you out of your own data and demands payment to decrypt it. For a dental practice or accounting firm, that means a day when the schedule won’t open, patient records are gone, and the accounting software is dark - while the phone keeps ringing. The real cost is rarely the ransom itself; it is the downtime, the recovery, and the breach-notification duty that follows. According to Sophos’s State of Ransomware research, recovery costs routinely run to several times the ransom demanded.
The attack almost never starts with a movie-style break-in. The most common way in is a service exposed to the internet: a remote desktop (RDP) port, an admin panel, or an open database. The attacker finds it with a scanner, guesses or buys a password, and deploys the ransomware. We walk through the one-open-port mechanism on a concrete example in one open port: how ransomware reaches a business.
The scale of this in our own data is striking. Of the practices we put through a deeper service scan, 60% had a publicly reachable MySQL database (port 3306), and 40% had an unencrypted FTP server exposed. Each of those is an open door - no phishing required to walk through it. Two moves cut ransomware risk the fastest: close the services you don’t need to expose, and keep a 3-2-1 backup (three copies, two media, one off-site) with one copy the attacker can’t reach.
From break-in to encryption usually takes anywhere from a few hours to a few days. In that window the attacker moves through the network, steals a copy of the data (to later threaten leaking it), and deletes any backups it can find. That is why a backup wired permanently to the same computer is not a backup - it dies with everything else. What counts is a separated copy: offline, or immutable, where ransomware can’t touch it. Test that you can actually restore it, too - an untested backup is an assumption, not a safeguard. For health practices, a ransomware breach also means appearing on the HHS public breach portal, a reputational hit a small practice feels for years.
5. BEC and wire fraud
Business email compromise (BEC) goes straight for the money. The pattern is repeatable: an attacker gets into an inbox - usually through phishing or a leaked password - and reads the correspondence for weeks, learning who pays whom and when. Then, just before a payment is due, they send a real-looking invoice with a changed account number. The money lands in a money-mule account before anyone notices. BEC is consistently one of the costliest categories the FBI IC3 tracks, with reported losses around $2.9 billion in a single recent year.
An accounting or CPA firm is a particular target, because it authorizes transfers for many clients and works against hard deadlines - quarterly filings, payroll, vendor payments. In that rhythm a swapped invoice slips through easily. A single successful change can cost the equivalent of months of a small firm’s revenue, and during tax season the pressure that makes it work is at its peak.
Two gaps from our scans make this attack easier. First, leaked passwords: at 17% of the practices we scanned, a staff email address showed up in a known breach alongside a plaintext password - a ready-made key to the inbox. Second, lookalike domains: for some businesses, near-identical variants of their domain were already registered with working mail, primed for impersonation. The defense is MFA on email, verifying any change of bank details on a second channel (a phone call, not a reply to the same thread), and monitoring for leaked credentials. More on the firm angle on our accounting firm security page.
6. Data breaches, weak passwords, and exposed services
A data breach is rarely a single dramatic event - more often it’s the result of slow neglect. The most common route runs through passwords. Attackers take billions of username-password pairs from earlier breaches and test them automatically against other services (this is credential stuffing). If an employee reused one password across a personal site and the business email, one old leak opens your system today.
The second route is services exposed straight to the internet. A public database, a website admin panel, or a file server visible from outside is not a theoretical risk - in our scans, 60% of the practices we checked more deeply had a database reachable publicly. Data can often be pulled from it with no “hacking” at all, just by connecting. Add the absence of multi-factor authentication (MFA), and every stolen password turns into full access.
A data breach also has a legal dimension, and in the US the clock depends on the data. A health-data breach falls under HIPAA, which gives up to 60 days to notify individuals and HHS; a breach of customer financial data at an accounting firm falls under the FTC Safeguards Rule, which requires notifying the FTC within 30 days for incidents affecting 500 or more consumers; and all 50 states add their own breach-notification laws on top. We map these obligations in the guide to data security compliance. The first three defenses are cheap: a password manager, MFA on every account, and a check for whether your credentials are already circulating in a breach.
7. Threats across three practice types
The same threats look different depending on the data you hold and the systems you run.
Dental practice. The prize is patient records and X-ray images - protected health information under HIPAA. Ransomware that locks the practice-management system (Dentrix, Eaglesoft, Open Dental) stops appointments cold, and a records breach means both an HHS filing and lost patient trust. What to do about it is on our dental practice security page.
Accounting / CPA firm. Here phishing and BEC dominate, because money and deadlines are always at the end of the line. There’s also a double duty: protecting your own data and the client financial data you hold under the FTC Safeguards Rule. Details on our accounting firm security page.
Medical spa. The most sensitive asset is before-and-after patient photos - health data and a reputational matter at once. A leak or a posting without proper consent is a legal and brand risk together. More on our medical spa security page.
8. Where to start: defense priorities for small business
You don’t have to do everything at once. Most of the risk above disappears after a few specific moves, and the order matters. The table below reduces each threat to one first defensive action.
| Threat | What the attack looks like | First defensive move |
|---|---|---|
| Phishing | A fake email or text pushes someone to click or enter a password | Turn on MFA and set up SPF, DKIM, DMARC |
| Ransomware | Files encrypted and a ransom demanded after entry through an exposed service | A 3-2-1 backup with one offline copy; close services you don’t use |
| BEC (wire fraud) | A hijacked inbox swaps the account number on a real invoice | Verify any payment-detail change on a second channel; MFA on email |
| Data breach | Account taken over with a leaked password; database stolen | A password manager and a check for leaked credentials |
| Exposed service | A public database, panel, or FTP visible from the internet | An external scan and closing ports you don’t need |
| Human error | Data sent to the wrong person, a weak password, a missed update | Updates, least-privilege access, and short training |
If you do only one thing after reading this, find out what your business exposes to the internet. You can’t judge that from the inside - it takes the outside view, the same one an attacker has. An external scan surfaces open services, a spoofable domain, and leaked passwords before anyone uses them. That is exactly what our external vulnerability assessment does, and its free first step is a PreScan. You’ll find scope and options on the pricing page.
FAQ
What are the most common cyber threats to small businesses?
The most common threats to small businesses are phishing and social engineering, ransomware, business email compromise (BEC), and data breaches through weak passwords and exposed services. They share one trait: the attack usually starts automatically, from a gap visible on the internet, not from someone choosing your business by name.
Is my small business really a target for cyberattacks?
Yes. Most attacks on small businesses are automated - scanners sweep entire IP ranges for an exposed service, a missing MFA prompt, or a spoofable domain. A small practice is a target because it is often easier to breach, not despite its size. Health and financial data make the payoff larger still.
What is the most common way businesses get attacked?
The most common entry point is phishing - a fake email or text that gets someone to click a link or enter a password. It works because it targets a person, not a system. The second common route is an account taken over with a password from an earlier breach. MFA blocks most of both.
How much does a ransomware attack cost a small business?
Ransomware’s real cost is rarely the ransom - it’s the downtime. For a small practice, a few days without scheduling, patient records, or accounting software means lost revenue, recovery costs, and breach-notification exposure. A working, offline backup is far cheaper than any negotiation with an attacker.
How do I start protecting my business from cyber threats?
Start by seeing what’s exposed to the internet: which services are open, whether your email can be spoofed, and whether staff passwords have leaked. An external scan surfaces real gaps before an attacker does. Then turn on MFA, fix your backups, and close services you don’t use.
Related guides
- One open port: how ransomware reaches a business
- SPF, DKIM, and DMARC explained
- External vulnerability assessment - shows what your business exposes to the internet
Neighboring guides:
- Phishing: what it is and how to protect your business
- Data security compliance for US small businesses
Not sure which of these threats you’re actually exposed to? Book a free PreScan - we’ll show you what’s visible from the internet: open services, a spoofable domain, and leaked passwords, before an attacker finds them.