Why Small Businesses Are Targeted by Cyber Criminals More Often

Here’s a number that doesn’t match the story most small business owners tell themselves: in the 2024–25 financial year, large Australian businesses reported the highest average loss per cyber incident, $202,700, well above what small or medium businesses reported. If that number just made you feel briefly safer as a small business owner, it shouldn’t. Large businesses reported that loss far less often. Small and medium businesses are hit far more frequently, and frequency, not the size of any single payout, is what drives most cybercriminal targeting decisions.

The Number That Doesn’t Fit the Story

According to the Australian Signals Directorate’s Annual Cyber Threat Report 2024–25, released 14 October 2025, the average self-reported cost of a cyber incident varied sharply by business size: small business costs rose 14 per cent to $56,600, medium business costs rose 55 per cent to $97,200, and large organisations reported an average cost of $202,700, up a striking 219 per cent.

Read in isolation, that looks like an argument for large businesses being the more urgent target. ASD’s own report cautions against that reading. Large business reports account for just over 12 per cent of all business cybercrime reports, the lowest share of any business size, and ASD flags that the dramatic increase in large business losses may partly reflect this low reporting volume, which makes the average more susceptible to distortion by a small number of very large outlier losses. ASD points to one specific driver behind that distortion: a 138 per cent increase in total business email compromise losses reported by large businesses in the same period, a concentrated jump in one loss category that can pull an average sharply upward on its own.

In other words: a handful of very expensive incidents at large companies can drag the average sharply upward, without that average telling you anything about how often large businesses are actually being targeted.

What “Targeted More” Actually Means

The more reliable measure of targeting isn’t average dollar loss, it’s frequency and victimisation rate. On that measure, the picture for small and medium businesses is clearer.

The Australian Institute of Criminology’s Cybercrime in Australia 2024 report, cited directly in ASD’s own report, found that small-to-medium enterprise owners experienced significantly higher rates of all types of cybercrime in both 2023 and 2024 compared to other groups, and in 2024, 22 per cent of respondents who owned or operated an SME reported their business had been impacted by cybercrime, unchanged from the 2023 survey.

The AIC’s own findings add a genuine nuance worth including rather than glossing over: a smaller proportion of SME owners were victims of malware and fraud and scams in 2024 than in 2023, even as a higher proportion of SME owners sought help from police or ReportCyber for certain types of cybercrime. That combination, lower reported victimisation alongside higher reporting, means the rise in SME reporting volume can’t be read purely as a sign that underlying targeting has increased. It may also reflect SMEs becoming more willing to formally report incidents than they were previously. Separately, when SME owners did fall victim, they were more likely than other victims to have lost money or spent money dealing with the consequences, and tended to lose larger amounts relative to other victim types.

This aligns with the broader volume pattern in ASD’s report. Across FY2024–25, ASD’s Australian Cyber Security Centre received over 84,700 cybercrime reports in total, an average of one every six minutes. That total includes reports from individuals, who make up the largest share overall, but looking specifically at business reports, large businesses account for just over 12 per cent, meaning nearly nine in ten business reports to ASD come from small and medium operators.

Why Attackers Prefer Volume Over Value

This isn’t a mystery once you think about it from the attacker’s side of the ledger rather than the victim’s.

A large enterprise is a higher-value target, but also a harder one: dedicated security teams, layered technical defences, incident response contracts already in place. Compromising one takes more time, more skill, and carries a higher chance of detection before the attacker extracts anything useful.

A small or medium business is a different equation. Fewer of these defences exist by default, not through any fault of the business owner, but because dedicated 24/7 security monitoring is expensive and most SMEs haven’t needed to build it the way an enterprise has. That makes each individual small business an easier, faster compromise. Cybercriminals running attacks at scale, often using automated tools rather than manually targeting each victim, are optimising for the number of successful compromises across many targets, not the size of any single payout.

ASD’s own data shows how effective opportunistic attacks on common, unmonitored infrastructure can be: of the more than 120 incidents involving attacks on edge devices like routers and firewalls in FY2024–25, 96 per cent succeeded. These are exactly the kind of unglamorous, everyday devices a small business is less likely to have someone actively monitoring.

This is also why ransomware and cyber extortion remain such a persistent threat category. In FY2024–25, ASD’s ACSC responded to 138 ransomware incidents, and 39 per cent of these were identified only because ASD proactively contacted the affected entity, meaning the business itself hadn’t detected the compromise. That detection gap tends to be wider in organisations without dedicated security monitoring, which describes most small and medium businesses.

The healthcare sector is a useful illustration of exactly the combination attackers look for, rather than an exception to the pattern above. Ransomware incidents against healthcare doubled year on year, and malicious actors succeeded in 95 per cent of healthcare and social assistance incidents ASD responded to, compared to a success rate of just under 52 per cent across all sectors combined. Healthcare providers, like many SMEs, often carry sensitive data without the security budget of a large enterprise, the data-rich, budget-poor combination that makes a target genuinely attractive regardless of its size.

What Cyber Extortion Actually Involves

Cyber extortion, ransomware and malware are related but distinct threats, and getting the distinction right matters for understanding your exposure. Extortion is the act of an attacker threatening to release or withhold access to your data unless paid. Ransomware is the specific type of malicious software often used to carry out that threat by locking you out of your own systems. Malware is the broader category both sit within. For a fuller breakdown, see our Cyber Insurance page.

What’s changed recently isn’t the basic mechanics of extortion, it’s the regulatory environment businesses now operate in when it happens.

The Regulatory Backdrop: Mandatory Ransomware Reporting

Since 30 May 2025, Part 3 of the Cyber Security Act 2024 has required certain businesses to report ransomware and cyber extortion payments to ASD. It’s worth being precise about what actually triggers this obligation, because it’s narrower than “an incident occurring.” The report is required when your business makes a ransomware or cyber extortion payment, or becomes aware that a payment has been made on its behalf, not simply on receiving a demand. If your business is threatened but never pays, there’s no reporting obligation under this regime. Where a payment is made, you have 72 hours from that point to report it, and there’s no minimum payment threshold, any benefit, monetary or otherwise, triggers the obligation.

This applies to businesses with an annual turnover of $3 million or more, along with operators of critical infrastructure. The regime ran on an education-first basis from 30 May to 31 December 2025, meaning enforcement focused on guidance rather than penalties. That period has now ended. Non-compliance can now attract a civil penalty of up to 60 penalty units, currently $19,800.

If your business turns over $3 million or more annually, this isn’t optional guidance, it’s a legal obligation, and the leniency period that existed while businesses got used to it is over. Many businesses in this bracket still don’t have a clear internal process for who makes that report, or how quickly, which is worth resolving before an incident forces the question.

What Cyber Insurance Actually Covers

For a fuller picture of how business interruption cover specifically responds to a cyber event, see our Business Interruption page.

Where This Leaves Small and Medium Businesses

None of this means large businesses are safe from cyber extortion, they clearly aren’t. What it means is that the common assumption, that a business is “too small to be worth targeting,” gets the economics backwards. Being smaller doesn’t reduce the likelihood of being targeted. It often increases it, because smaller businesses are frequently the easier target, not the less interesting one.

For most SMEs, the practical consequence is straightforward: cyber insurance isn’t a large-enterprise product that happens to also be available to smaller businesses. Given the frequency data above, it’s arguably more relevant to a small or medium business than to a large one, precisely because small businesses are the ones absorbing the bulk of the reported incidents.

The Real Takeaway

The comforting version of this story, that cybercriminals go after the big fish, isn’t what the most recent Australian data shows. Attackers are largely optimising for ease and volume, and that consistently favours smaller, less defended targets over large ones. If your business has been assuming its size makes it a low priority, the frequency data suggests the opposite may be true.

Want to understand how your current cover responds to a cyber extortion event? Speak with Knightsbridge Insurance Group about reviewing your cyber insurance.

A Practical Starting Point

1. Do you know how you’d detect a compromise? Given that a meaningful share of ransomware incidents in the ASD report were identified only because ASD proactively contacted the victim, ask whether your business has any way of detecting unusual account or system activity on its own.
2. Do you know your reporting obligations if your turnover is near or above $3 million? Confirm whether the mandatory ransomware payment reporting regime applies to your business, that a payment, not a demand, is what triggers it, and who within the business is responsible for making that report within 72 hours.
3. Have you reviewed what your current insurance actually covers? Many businesses assume general liability or property cover extends to cyber incidents. It generally doesn’t. Confirm specifically whether extortion payments, incident response costs, and business interruption from a cyber event are covered.
4. Have you tested your backup and recovery process, not just set it up? A backup that hasn’t been tested is an assumption, not a plan.
5. Do your staff know what a phishing attempt looks like, specifically for your business? Generic training helps, but staff are more likely to catch an attempt that mimics how your business actually communicates internally.

Important Disclaimer: This article provides general information only and does not constitute legal or financial advice. Drone regulations, privacy law obligations, and insurance coverage for commercial drone operations vary significantly based on individual operators, states and territories, and insurers. Regulatory requirements referenced, including CASA’s trial BVLOS pathways and ongoing Part 101 consultation, are subject to change. Readers should confirm current requirements directly with CASA and the OAIC, and consult with qualified legal and insurance professionals before making decisions about drone operations or coverage. Knightsbridge Insurance Group holds Australian Financial Services Licence 514855.

Frequently Asked Questions