This board-level review summarises cyber incidents in 2025, outlining key trends, business impact, and risk exposure. It presents research data and statistics on ransomware activity and payment fraud.
From a security standpoint, 2025 was a challenging year for many small and medium-sized businesses. Threat actors continued to shift their attention toward SMEs—not because they are headline-worthy targets, but because they remain easier to compromise and sit at critical points within larger supply chains. As a security advisor, I can say with certainty: SMEs are now firmly on the radar of cybercriminals. The belief that “we’re too small to be targeted” has become a dangerous misconception.
Many of the incidents below could have been contained earlier with responsive IT support and monitoring from a dedicated team.
Key Figures & Statistics: Notable Global Incidents (2025)
- A major insurance-related breach impacted 22.65 million people, exposing personal and policy data.
- Multiple global SaaS and technology providers were hit by large third-party and supply-chain compromises, with up to 1.5 billion records exposed in a single cluster of identity token breaches.
These large-scale events created ripple effects across dependent SMEs, further exposing smaller organisations through their tools, partners, and vendors.
Comparative Trends: 2024 vs 2025
- Ransomware in breaches: increased from ~32% in 2024 to ~44% in 2025.
- UK businesses hit by ransomware: rose from <0.5% in 2024 to ~1% (≈19,000 SMEs) in 2025.
- Global cybercrime cost projection: grew from ~£5.2T (circa U$7T) to ~£7.8T (circa U$10.5T).
- Identity-based attacks: saw a +32% surge in 2025.
The numbers show a clear escalation: attack volume, cost, and complexity all rose sharply in 2025, with SMEs absorbing a growing share of the impact.
Evidence of Cyber Impact on SMEs in 2025
1. Ransomware Targeting SMEs
Ransomware continued to dominate the SME threat landscape throughout 2025:
- 46% of small businesses reported experiencing a cyberattack in 2025, including ransomware, phishing, and fraud.
- Research shows up to 88% of SMB breaches involved ransomware, far higher than in large enterprises.
- Ransomware attacks on small businesses increased approximately 20% year-on-year.
- 75% of SMEs said they would struggle to continue operating after a major ransomware event.
- 12% of SMEs received a ransom demand in 2025—and almost half expressed ongoing concern about ransomware targeting their websites and data.
What This Means for SMEs
These findings highlight two critical realities:
- Attackers are deliberately prioritising SMEs. SMEs often lack dedicated security teams, tested incident plans, and advanced defences—making them attractive for quick, high-success-rate attacks.
- Ransomware mitigation must become a strategic priority. This is no longer an IT problem—it’s a business continuity and risk-management issue.
2. Payment Fraud Through Email Compromise (BEC)
Business Email Compromise (BEC) remained one of the most financially damaging cybercrimes affecting SMEs in 2025. BEC is a targeted attack where cybercriminals impersonate trusted leaders to trick employees into sending money or data.
Key BEC Figures (2025)
High financial impact
- BEC losses reached approximately £4.8 billion (circa U$6.3 billion) globally, with an average loss of £40,000 (circa U$50,000) per incident.
Rising incident volume
- In early 2025, BEC activity surged, with month-over-month increases up to 37%.
- BEC accounted for 36.8% of all email-related cyber incidents tracked across multiple datasets.
Underlying attack drivers
- Social-engineering and impersonation scams grew sharply, with early-year spikes of up to 60% reported.
- Credential phishing remained the primary enabler, responsible for nearly half of all fraudulent fund-transfer attempts.
Long-running financial damage
- BEC has accounted for over £6.7 billion (Circa U$8.5 billion) in losses over the past three years—demonstrating the ongoing scale and persistence of email-based fraud.
Advisory Interpretation
BEC attacks succeed not because SMEs lack technology, but because:
- Payment approvals aren’t consistently followed
- Staff struggle to identify sophisticated impersonation
- Multi-step verification is rarely enforced
- Attackers exploit trust and routine business processes
SMEs must treat email and payment fraud as a core financial-risk issue, not simply a cybersecurity concern.
Closing Thoughts
2025 was a defining year for SMEs—not only because cyber threats increased, but because those threats evolved in sophistication and impact.
AI-powered scams will accelerate - Phishing is no longer poorly written spam. AI now generates near-perfect emails, messages, and even voice prompts. This makes deception faster, more scalable, and more convincing.
Regulatory expectations will continue rising - Throughout 2025, compliance frameworks tightened. SMEs are now expected to maintain clearer processes, proper documentation, and faster reporting—regardless of their team size or technical maturity.
The Path Forward - The challenges in 2026 will be real. But with the right focus, practical controls, and a proactive mindset, SMEs can significantly reduce their exposure.
The SMEs that act now—strengthening defences, planning ahead, and addressing real risks—will be the ones that move into 2026 with confidence. You don’t need enterprise budgets to be secure; you need the right safeguards. Cyber resilience is no longer optional; it’s a core requirement for staying in business.
