Small business cyber attack statistics from Verizon’s 2026 DBIR show ransomware in 48% of all breaches and a human element in 62%, while secondary coverage puts about 96% of ransomware victims with a documented size in the small-organization group. The report analyzed more than 31,000 incidents. This guide covers what the data says about how small firms are breached and which controls match each route.
Last reviewed: October 6, 2026. Some figures come from coverage of the report and are marked as such. This is general information, not security advice.
Key takeaways
- The 2026 DBIR analyzed more than 31,000 incidents and more than 22,000 confirmed breaches in 145 countries.
- System intrusion was the leading breach pattern at 61%, ahead of social engineering at 17%.
- The human element appeared in 62% of breaches, up from 60%.
- Ransomware was present in 48% of breaches, up from 44% in 2025.
- Coverage of the report says about 96% of ransomware victims with a documented size were small organizations.
How breaches happen
The Verizon 2026 Data Breach Investigations Report, published in May 2026, sorts breaches into patterns. Figure 1 shows the five largest. System intrusion, which covers malware, ransomware and hacking, accounts for most of them.
Exploiting a vulnerability was the most common first step across all organizations, at 31% of breaches, ahead of credential abuse at 13%. Third parties were involved in 48% of breaches, according to Help Net Security’s summary. A small business is part of other companies’ supply chains and uses vendors of its own, so both directions matter.
What it means for small organizations
The report’s small business section was not available in the sections we could read, so the size-specific figures below come from SOCRadar’s summary and the Cyber Readiness Institute’s. They say compromised credentials were the first step in 38% of small business breaches and edge-device vulnerabilities in 29%. They also report that about 96% of ransomware victims with a documented size were small organizations. That is a share of ransomware victims, not of all breaches. Figure 2 compares ransomware rates.
The 88% figure for smaller organizations comes from coverage of the 2025 report, so compare it with the 44% for all breaches in that same year. Even allowing for the different definitions and editions, ransomware is clearly a bigger part of the small business picture.
Four common routes and the control for each
| Route in | First control |
|---|---|
| Stolen or reused passwords | Multi-factor authentication and a password manager |
| Unpatched edge devices and software | Scheduled updates and vulnerability scanning |
| Phishing and social engineering | Email filtering, training and a call-back rule for payments |
| Ransomware | Tested offsite backups and limited administrator access |
Three steps to start with
1. Protect logins
Cyber attack statistics put stolen credentials first. Turn on multi-factor authentication for email, banking and any admin account. Stolen credentials led the small business list, and a second factor makes a stolen password far less useful.
2. Patch the edges
Cyber attack statistics also show edge devices as a common way in. Firewalls, VPNs and routers face the internet and are easy for attackers to scan. Keep their firmware current and remove remote access you do not use. Our cybersecurity services cover hardening and monitoring for small teams.
3. Make ransomware recoverable
Cyber attack statistics on ransomware make recovery planning worth the effort. Keep a tested copy of your data that an infected computer cannot reach. Our backup and disaster recovery service is built for that. With a clean restore, the ransom question loses most of its force.
Frequently asked questions about small business cyber attack statistics
How many cyber attacks hit small businesses?
The 2026 Verizon DBIR analyzed more than 31,000 incidents, including more than 22,000 confirmed breaches, across 145 countries. Coverage of the report says about 96% of ransomware victims with a documented size were small organizations. The DBIR is a sample of reported cases, so it shows patterns and not a count of every attack.
What is the most common way small businesses are breached?
Secondary coverage of the 2026 report lists compromised credentials (38%) and vulnerabilities in edge devices (29%) as the leading ways into small business breaches. Across all organizations, exploiting a vulnerability was the top initial access vector at 31% of breaches.
How much of cybercrime involves a human?
The DBIR found a human element in 62% of breaches in 2026, up from 60% the year before. That covers actions such as clicking a phishing link, using stolen credentials and making an error.
Do small businesses pay ransoms?
Coverage of the 2026 report says about 69% of ransomware victims did not pay. A business that can restore its own data has far less reason to pay.
How does the DBIR define a small business?
The sources we could read do not give an employee count. Past editions have split organizations at 1,000 employees, which we have not confirmed for 2026, so check the report before comparing it with other data.