Ransomware Still Targets Small Business First — Not Enterprise

The ransomware stories that make national news are almost always about large companies: a hospital system, a pipeline, a household-name retailer. That coverage creates a quiet, false comfort for small business owners, the sense that ransomware is mostly a big-company problem. The data says the opposite.

The current numbers

• Over two-thirds of ransomware attacks between 2024 and 2025 targeted businesses with fewer than 500 employees (Gray, Gray & Gray LLP).
• Ransomware makes up 88% of small-business cyberattacks, versus 39% for large companies (Verizon 2025 Data Breach Investigations Report). Not just more common in raw numbers, but a much larger share of everything small businesses face.
• Ransomware accounts for roughly 40% of small and mid-size businesses' disruptive cybersecurity incidents (Cyentia).
• Even among businesses that pay a ransom, only up to 60% recover some or all of their data. Payment is not a reliable path back to normal (Hiscox).

Why small businesses specifically

Attackers don't think small businesses are more valuable targets. They're just easier ones. Fewer companies under 500 employees run 24/7 monitoring, have a dedicated security team, or have tested their backups recently. Most ransomware campaigns are automated and aren't hand-picking victims. They're scanning for whichever door is unlocked. A business without EDR, without MFA everywhere, without monitored backups, is simply a faster, lower-effort target than one with a security operations center watching in real time.

What moves the needle

None of the controls that meaningfully reduce this risk are exotic or enterprise-only: MFA enforced everywhere, endpoint detection and response instead of legacy antivirus, offline/immutable backups that get restore-tested rather than assumed to work, and 24/7 monitoring that catches the early stages of an intrusion before it becomes an encryption event. Small businesses can access every one of these controls just as easily as a large company can. What's usually missing is a dedicated IT security partner whose job is making sure they're in place and working, not just purchased and forgotten.