{"id":5404,"date":"2026-09-12T09:00:00","date_gmt":"2026-09-12T09:00:00","guid":{"rendered":"https:\/\/yamuparkoti.com\/?p=5404"},"modified":"2026-08-21T19:38:26","modified_gmt":"2026-08-21T19:38:26","slug":"ransomware-amal-saghira-data","status":"publish","type":"post","link":"https:\/\/yamuparkoti.com\/ar\/ransomware-small-business-data\/","title":{"rendered":"Ransomware and Small Business: The Real Numbers"},"content":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack<\/strong>.<\/p>\n

It appears everywhere. News outlets, vendor pages, government talks, conference slides.<\/p>\n

There is one problem with it.<\/p>\n

It is not true, and the organisation usually credited with it has publicly said so.<\/strong><\/p>\n

The National Cybersecurity Alliance issued a statement confirming the figure did not come from their research and that they cannot verify its source (National Cybersecurity Alliance, 2026).<\/p>\n

So let us look at what the real numbers say instead. \ud83d\udee1\ufe0f<\/p>\n

\ud83c\udf81 Compare Backup and Security Trials \u2192<\/a><\/p>\n

\ud83e\uddfe \u0644\u0645\u062d\u0629 \u0633\u0631\u064a\u0639\u0629 \u0639\u0646 \u0627\u0644\u0646\u062a\u0627\u0626\u062c \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
\u0642\u064a\u0627\u0633<\/th>\n\u0627\u0644\u0634\u0643\u0644<\/th>\n\u0645\u0635\u062f\u0631<\/th>\n<\/tr>\n<\/thead>\n
The famous “60% close” figure<\/td>\nUnverified, disavowed<\/strong><\/td>\nNational Cybersecurity Alliance (2026)<\/td>\n<\/tr>\n
SMBs going out of business after an attack<\/td>\nAbout 19%<\/strong><\/td>\nMastercard survey, cited 2026<\/td>\n<\/tr>\n
Cyberattacks aimed at SMBs<\/td>\nAbout 43%<\/td>\nAstra (2026)<\/td>\n<\/tr>\n
Ransomware present in SMB breaches<\/td>\n88%<\/strong><\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Same figure at large organisations<\/td>\n39%<\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Average ransomware downtime<\/td>\nAbout 24 days<\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Recovery cost, excluding ransom<\/td>\n$1.53 million average<\/strong><\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Typical small business range<\/td>\n$120,000 to $1.24 million<\/td>\nSQ Magazine (2026)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\"Ransomware<\/p>\n

\ud83e\udddf The Statistic That Refuses to Die<\/h2>\n

This deserves proper attention, because it shapes how people think about the whole topic.<\/p>\n

The 60% claim first appeared around 2011.<\/p>\n

It has been repeated for roughly fifteen years without anyone producing the underlying study.<\/p>\n

What the NCSA actually said<\/h3>\n

The National Cybersecurity Alliance is the body most often credited with the figure.<\/p>\n

They published a statement noting the statistic was not generated from their research.<\/p>\n

They also confirmed they cannot verify its original source.<\/strong><\/p>\n

They stopped using it in their own materials.<\/p>\n

Why it spread so effectively<\/h3>\n

It is memorable, alarming and useful to anyone selling security products.<\/p>\n

Each retelling cited the previous one rather than any primary source.<\/p>\n

After enough repetitions, it looked like established fact.<\/p>\n

\n

\ud83d\udcca The myth against the measured figure<\/p>\n

\n\n\n60%<\/text>\nWidely repeated claim<\/text>\nunverified<\/text>\n\n19%<\/text>\nMeasured in survey<\/text>\n5,000+ owners<\/text>\nSources: National Cybersecurity Alliance (2026) disavowal; Mastercard survey, cited 2026.<\/text>\n<\/svg>\n<\/div>\n

What the real number appears to be<\/h3>\n

A Mastercard survey covered more than 5,000 small business owners. Almost one in five who suffered an attack went out of business.<\/p>\n

That is roughly 19%, not 60%.<\/p>\n

Still serious. Still a fifth of affected businesses. But a third of the claim.<\/strong><\/p>\n

Why the correction matters<\/h3>\n

Inflated statistics do not make people safer.<\/p>\n

They make the problem feel unsurvivable, which encourages fatalism rather than action.<\/p>\n

And when someone discovers one figure was invented, they discount the accurate ones too.<\/p>\n

\ud83d\udd0e Try Backup Tools Free \u2192<\/a><\/p>\n

\ud83c\udfaf Why Small Businesses Are Targeted<\/h2>\n

The genuine finding here is stark, and better evidenced than the myth.<\/p>\n

Ransomware was present in 88% of breaches at small and mid-sized businesses<\/strong> (Verizon, 2025).<\/p>\n

At large organisations the figure was 39%.<\/p>\n

More than double the rate.<\/p>\n

\n

\ud83d\udcca Ransomware present in breaches, by organisation size<\/p>\n

\n\n\n88%<\/text>\nSmall and mid-sized<\/text>\n\n39%<\/text>\nLarge organisations<\/text>\nSource: Verizon Data Breach Investigations Report (2025).<\/text>\n<\/svg>\n<\/div>\n

Why the gap exists<\/h3>\n

Large organisations have security teams, tested backups and incident plans.<\/p>\n

They still get attacked, but ransomware succeeds less often.<\/p>\n

Small businesses are not attacked more because they are chosen. They are attacked more because attacks succeed.<\/strong><\/p>\n

The automation point<\/h3>\n

Most ransomware is not targeted at a specific company.<\/p>\n

Automated tools scan for known weaknesses across the whole internet.<\/p>\n

Being small does not make you invisible. It often makes you easier.<\/p>\n

\u23f1\ufe0f What an Attack Actually Costs<\/h2>\n

The financial figures are wide, and the reason is worth knowing.<\/p>\n\n\n\n\n\n\n\n\n\n
Cost element<\/th>\nTypical scale<\/th>\n<\/tr>\n<\/thead>\n
Downtime<\/td>\nAround 24 days on average<\/strong><\/td>\n<\/tr>\n
Recovery excluding ransom<\/td>\n$1.53 million average<\/td>\n<\/tr>\n
Small business range<\/td>\n$120,000 to $1.24 million<\/strong><\/td>\n<\/tr>\n
Ransom itself<\/td>\nHighly variable, often not the largest cost<\/td>\n<\/tr>\n
Lost customers<\/td>\nRuns long after recovery<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Note that the ransom is rarely the biggest line.<\/p>\n

Twenty-four days of downtime destroys more value than most ransom demands.<\/strong><\/p>\n

Why downtime dominates<\/h3>\n

A business that cannot invoice, deliver or answer customers for three weeks is in serious trouble.<\/p>\n

Staff still get paid. Rent still falls due.<\/p>\n

Revenue stops while costs continue, and that gap is what closes companies.<\/p>\n

The range tells you something<\/h3>\n

$120,000 to $1.24 million is an enormous spread.<\/p>\n

The difference is almost entirely preparation.<\/p>\n

Businesses with tested backups recover in days. Those without recover in weeks or never.<\/p>\n

\ud83d\udcca Where the Money Actually Goes<\/h2>\n

Splitting the cost shows why preparation changes the outcome so much.<\/p>\n

\n

\ud83e\udd67 Typical ransomware cost breakdown<\/p>\n

\n\n\n\n\ntotal cost<\/text>\nDowntime and lost revenue<\/text>\nRecovery and IT work<\/text>\nLegal, notification, advice<\/text>\nRansom, where paid<\/text>\nIndicative split. Downtime dominates (Huntress, 2026).<\/text>\n<\/svg>\n<\/div>\n

Notice how small the ransom slice is.<\/p>\n

Most of the damage happens while the business cannot operate.<\/strong><\/p>\n

Why that changes what to spend on<\/h3>\n

If downtime is the main cost, the main defence is fast recovery.<\/p>\n

That means tested backups, not just more prevention tools.<\/p>\n

A business that restores in two days avoids most of the loss (SQ Magazine, 2026).<\/p>\n

The sectors that suffer longest<\/h3>\n

Recovery times vary widely by industry.<\/p>\n

Manufacturing tends to be slowest, because physical processes stop.<\/p>\n

Financial firms recover fastest, largely because they rehearse it (Huntress, 2026).<\/p>\n

\ud83d\udcbe Why Backups Are the Whole Game<\/h2>\n

Ransomware works by making your data unavailable.<\/p>\n

A working backup makes that threat far weaker.<\/p>\n

But most backup setups fail at the moment they are needed.<\/p>\n\n\n\n\n\n\n\n\n\n
Common failure<\/th>\nWhy it happens<\/th>\n<\/tr>\n<\/thead>\n
Backup was never tested<\/td>\nNobody tried restoring<\/strong><\/td>\n<\/tr>\n
Backup drive was connected<\/td>\nEncrypted along with everything else<\/td>\n<\/tr>\n
Backup stopped months ago<\/td>\nFailure alerts ignored<\/td>\n<\/tr>\n
Only some data covered<\/td>\nNobody audited what was included<\/td>\n<\/tr>\n
Restore takes too long<\/td>\nTechnically works, practically useless<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The second row catches many businesses.<\/p>\n

A backup drive left plugged in gets encrypted with the rest.<\/strong><\/p>\n

The rule that works<\/h3>\n

Keep at least one backup copy disconnected or immutable.<\/p>\n

Cloud backups with versioning handle this well, since older versions survive.<\/p>\n

The principle is simple: ransomware should not be able to reach every copy.<\/p>\n

Test the restore, not the backup<\/h3>\n

This is the step nearly everyone skips.<\/p>\n

A backup that runs successfully is not proof you can recover.<\/p>\n

Restore a few real files, quarterly. It takes fifteen minutes.<\/p>\n

Keep one backup off the domain<\/h3>\n

Attackers who gain administrator access often target backup systems first.<\/p>\n

A backup managed by the same credentials as everything else can be deleted with everything else.<\/p>\n

At least one copy should be outside that control, with separate credentials.<\/strong><\/p>\n

Know your restore time<\/h3>\n

Ask how long a full restore would actually take.<\/p>\n

If the answer is a week, that is a week of downtime you have already accepted.<\/p>\n

\u0644\u062f\u064a\u0646\u0627 \u062a\u062d\u0644\u064a\u0644 \u062a\u0643\u0644\u0641\u0629 \u0627\u0644\u0627\u0646\u062a\u0647\u0627\u0643<\/a> covers why time dominates every cost calculation.<\/p>\n

\ud83d\udeaa How Ransomware Gets In<\/h2>\n

The entry routes are unglamorous and mostly preventable.<\/p>\n\n\n\n\n\n\n\n\n\n
\u0627\u0644\u0637\u0631\u064a\u0642<\/th>\n\u0627\u0644\u0648\u0642\u0627\u064a\u0629<\/th>\n<\/tr>\n<\/thead>\n
Stolen or reused credentials<\/td>\nMulti-factor sign-in<\/strong><\/td>\n<\/tr>\n
Phishing email<\/td>\nStaff awareness, email filtering<\/td>\n<\/tr>\n
Unpatched software<\/td>\nAutomatic updates<\/td>\n<\/tr>\n
Exposed remote access<\/td>\nClose it or put it behind MFA<\/strong><\/td>\n<\/tr>\n
Compromised supplier<\/td>\nHarder \u2014 ask about their security<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of five are addressable without much budget.<\/p>\n

\u0644\u062f\u064a\u0646\u0627 password research<\/a> shows MFA cut account compromise by over 99%.<\/p>\n

Remote access is the quiet one<\/h3>\n

Many small businesses expose remote desktop access to the internet.<\/p>\n

It is convenient, and automated scanners find it within hours.<\/p>\n

If you need remote access, it should sit behind MFA at minimum.<\/p>\n

Updates matter more than antivirus<\/h3>\n

Most successful attacks use weaknesses that were already patched.<\/p>\n

The patch existed. Nobody applied it.<\/p>\n

Automatic updates are free and prevent more than most paid products.<\/strong><\/p>\n

\ud83d\udcb8 The Ransom Question<\/h2>\n

If it happens, should you pay? The honest answer is layered.<\/p>\n

Law enforcement generally advises against it.<\/p>\n

Payment funds further attacks and marks you as willing to pay.<\/p>\n

What payment does not buy<\/h3>\n

It buys a decryption tool, from a criminal, with no guarantee.<\/p>\n

Recovery after payment is often partial and slow.<\/p>\n

And modern attacks steal data before encrypting, so payment does not prevent publication.<\/p>\n

Why that last point changed everything<\/h3>\n

Ransomware used to be about locking files.<\/p>\n

Now a large share of attacks also threaten to publish stolen data.<\/p>\n

Backups solve the encryption problem but not the publication problem.<\/strong><\/p>\n

\u0627\u0644\u0623\u062b\u0631 \u0627\u0644\u0639\u0645\u0644\u064a<\/h3>\n

\u0627\u0644\u0648\u0642\u0627\u064a\u0629 \u0623\u0635\u0628\u062d\u062a \u0623\u0643\u062b\u0631 \u0623\u0647\u0645\u064a\u0629 \u0645\u0645\u0627 \u0643\u0627\u0646\u062a \u0639\u0644\u064a\u0647 \u0645\u0646 \u0642\u0628\u0644\u060c \u0644\u0623\u0646 \u0627\u0644\u062a\u0639\u0627\u0641\u064a \u0623\u0635\u0628\u062d \u0623\u0642\u0644 \u0645\u0645\u0627 \u0643\u0627\u0646 \u0639\u0644\u064a\u0647 \u0645\u0646 \u0642\u0628\u0644.<\/p>\n

A perfect backup no longer makes you immune, only resilient.<\/p>\n

\ud83e\uddfe Which Small Businesses Get Hit Hardest<\/h2>\n

Exposure is not evenly spread, and the pattern is predictable.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u0639\u0627\u0645\u0644<\/th>\nRaises risk?<\/th>\n\u0644\u0645\u0627\u0630\u0627<\/th>\n<\/tr>\n<\/thead>\n
Holding customer payment data<\/td>\n\u0646\u0639\u0645<\/strong><\/td>\nHigher value to attackers<\/td>\n<\/tr>\n
Remote access exposed online<\/td>\n\u0646\u0639\u0645<\/td>\nFound by automated scanners<\/td>\n<\/tr>\n
Older unsupported software<\/td>\n\u0646\u0639\u0645 \u0628\u0642\u0648\u0629<\/strong><\/td>\nKnown weaknesses never patched<\/td>\n<\/tr>\n
Supplier to larger firms<\/td>\n\u0646\u0639\u0645<\/td>\nA route into bigger targets<\/td>\n<\/tr>\n
No dedicated IT support<\/td>\n\u0646\u0639\u0645<\/td>\nNobody watching for signs<\/td>\n<\/tr>\n
Regulated sector<\/td>\nCost, not likelihood<\/td>\nFines and notification duties<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The supplier row deserves attention, because it surprises people.<\/p>\n

A small firm can be attacked as a route into its largest customer.<\/strong><\/p>\n

That is why big companies increasingly ask suppliers about their security.<\/p>\n

The unsupported software problem<\/h3>\n

Software past end of life stops receiving fixes entirely.<\/p>\n

Every weakness found after that date stays open permanently.<\/p>\n

Automated scanners specifically look for these versions (Astra, 2026).<\/p>\n

Being a supplier changes your obligations<\/h3>\n

Larger customers may require evidence of controls before renewing contracts.<\/p>\n

That turns security from a cost into a condition of trading.<\/p>\n

Many small firms first take it seriously when a customer asks.<\/p>\n

\ud83d\udccb What a Small Business Should Actually Do<\/h2>\n

Ranked by protection per pound spent.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u0641\u0639\u0644<\/th>\n\u064a\u0643\u0644\u0641<\/th>\n\u062a\u0623\u062b\u064a\u0631<\/th>\n<\/tr>\n<\/thead>\n
MFA on email and remote access<\/td>\n\u062d\u0631<\/strong><\/td>\nBlocks the most common entry<\/td>\n<\/tr>\n
Automatic updates everywhere<\/td>\n\u062d\u0631<\/td>\nCloses known weaknesses<\/td>\n<\/tr>\n
One offline or immutable backup<\/td>\n\u0642\u0644\u064a\u0644<\/td>\nSurvives encryption<\/strong><\/td>\n<\/tr>\n
Quarterly restore test<\/td>\n15 \u062f\u0642\u064a\u0642\u0629<\/td>\nProves the backup works<\/td>\n<\/tr>\n
Close unused remote access<\/td>\n\u062d\u0631<\/td>\nRemoves a scanned target<\/td>\n<\/tr>\n
\u062e\u0637\u0629 \u0627\u0644\u062d\u0627\u062f\u062b \u0645\u0646 \u0635\u0641\u062d\u0629 \u0648\u0627\u062d\u062f\u0629<\/td>\nAn hour<\/td>\nSaves days of confusion<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of six cost nothing at all.<\/p>\n

The gap between prepared and unprepared businesses is mostly attention, not budget.<\/strong><\/p>\n

\u062e\u0637\u0629 \u0627\u0644\u062d\u0627\u062f\u062b \u0644\u0627 \u0623\u062d\u062f \u064a\u0643\u062a\u0628<\/h3>\n

Three questions on one page. Who decides? Who calls the insurer or lawyer? Who tells customers?<\/p>\n

Deciding that during an incident costs days.<\/p>\n

Deciding it in advance costs an hour.<\/p>\n

Train staff on one thing, not everything<\/h3>\n

Security awareness training often tries to cover too much and lands nowhere.<\/p>\n

Pick the single behaviour that matters most: report anything suspicious immediately, without blame.<\/p>\n

Most incidents are noticed by an ordinary employee before any system flags them.<\/strong><\/p>\n

If people fear being blamed, they stay quiet, and hours are lost.<\/p>\n

Cyber insurance, briefly<\/h3>\n

Policies increasingly require MFA and tested backups before paying out.<\/p>\n

Read those conditions before assuming you are covered.<\/p>\n

An insurer can decline if the required controls were not in place.<\/p>\n

\ud83d\udea8 The First Hour, If It Happens<\/h2>\n

Most damage in the early stage comes from panic rather than the attack itself.<\/p>\n

Knowing the sequence in advance is worth more than any single tool.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u0627\u0644\u0646\u0638\u0627\u0645<\/th>\n\u0641\u0639\u0644<\/th>\n\u0644\u0645\u0627\u0630\u0627<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nDisconnect affected machines from the network<\/strong><\/td>\nStops spread<\/td>\n<\/tr>\n
2<\/td>\nDo not power them off<\/td>\nPreserves evidence in memory<\/td>\n<\/tr>\n
3<\/td>\nCheck whether backups are reachable<\/td>\nDetermines your options<\/td>\n<\/tr>\n
4<\/td>\nNotify insurer and legal contact<\/td>\nPolicies often require early notice<\/strong><\/td>\n<\/tr>\n
5<\/td>\nStart a written timeline<\/td>\nRegulators will ask<\/td>\n<\/tr>\n
6<\/td>\nDecide who speaks to customers<\/td>\nPrevents mixed messages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Row two is counterintuitive and frequently got wrong.<\/p>\n

Powering a machine off destroys evidence that helps investigators understand what happened.<\/strong><\/p>\n

Why the insurer comes early<\/h3>\n

Many policies require notification within a short window.<\/p>\n

Some also require you to use their approved responders.<\/p>\n

Calling your own specialist first can jeopardise the claim.<\/p>\n

The notification clock<\/h3>\n

If personal data was involved, regulators often require reporting within 72 hours of discovery.<\/p>\n

That clock starts when you find out, not when you finish investigating.<\/p>\n

\u0644\u062f\u064a\u0646\u0627 \u062a\u062d\u0644\u064a\u0644 \u062a\u0643\u0644\u0641\u0629 \u0627\u0644\u0627\u0646\u062a\u0647\u0627\u0643<\/a> covers how that timing drives cost.<\/p>\n

Write it down as you go<\/h3>\n

Memory degrades fast during an incident.<\/p>\n

A simple timestamped log answers most later questions from insurers and regulators.<\/p>\n

It costs nothing and is almost never done.<\/p>\n

\ud83d\udd2c How Reliable Is This Data?<\/h2>\n\n\n\n\n\n\n\n\n
\u0645\u0635\u062f\u0631<\/th>\n\u0642\u0648\u0629<\/th>\n\u062a\u062d\u0630\u064a\u0631<\/th>\n<\/tr>\n<\/thead>\n
Verizon DBIR<\/td>\nLong-running, consistent method<\/strong><\/td>\nReported incidents only<\/td>\n<\/tr>\n
Mastercard SMB survey<\/td>\n5,000+ owners<\/td>\nSelf-reported<\/td>\n<\/tr>\n
Security vendor statistics<\/td>\nPractical detail<\/td>\nThey sell the solution<\/strong><\/td>\n<\/tr>\n
The 60% closure claim<\/td>\n\u0644\u0627 \u0623\u062d\u062f<\/td>\nDisavowed by NCSA<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

That bottom row is the lesson of this article.<\/p>\n

How to check a scary statistic<\/h3>\n

Trace it back until you reach an organisation that collected data.<\/p>\n

If every citation points to another article, you have found a rumour.<\/p>\n

A statistic with no primary source is not a statistic.<\/strong><\/p>\n

Why undercounting is likely too<\/h3>\n

Many small businesses never report attacks.<\/p>\n

They pay quietly, or recover without telling anyone.<\/p>\n

So real attack rates are probably higher than reported figures, even as closure rates are lower than claimed.<\/p>\n

\ud83e\uddef Why “We Are Too Small to Target” Is Wrong<\/h2>\n

This belief is the single most common reason small businesses do nothing.<\/p>\n

It rests on a misunderstanding of how attacks actually work.<\/p>\n

Nobody chose you<\/h3>\n

Most ransomware arrives through automated scanning, not selection.<\/p>\n

Tools sweep the internet looking for exposed services and known weaknesses.<\/p>\n

The attacker often learns who you are only after getting in.<\/strong><\/p>\n

Small does not mean cheap to attack<\/h3>\n

Automation removed the cost of trying.<\/p>\n

Scanning a million addresses costs barely more than scanning a hundred.<\/p>\n

So there is no economic reason to skip small targets.<\/p>\n

What actually deters an automated attack<\/h3>\n

Not obscurity. Just being harder than the next result on the list.<\/p>\n

Patched software, MFA and no exposed remote access are usually enough.<\/p>\n

These attacks pursue the easiest available target, not the most valuable one.<\/p>\n

The 43% figure in context<\/h3>\n

Around 43% of cyberattacks are aimed at small and mid-sized businesses (Astra, 2026).<\/p>\n

That is close to half of all attacks hitting the segment least prepared for them.<\/p>\n

Obscurity has not protected anyone for at least a decade.<\/p>\n

\ud83d\udeab \u0645\u0627 \u0644\u0627 \u062a\u062e\u0628\u0631\u0643 \u0628\u0647 \u0647\u0630\u0647 \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a<\/h2>\n

It does not predict your risk.<\/strong> Sector and exposure vary enormously.<\/p>\n

Survey data is self-reported.<\/strong> Owners may misremember causes.<\/p>\n

Unreported attacks are invisible.<\/strong> The true rate is likely higher.<\/p>\n

Cost ranges are extremely wide.<\/strong> Preparation drives most of the difference.<\/p>\n

Much research is vendor-published.<\/strong> Fear supports sales.<\/p>\n

\ud83c\udfc1 \u0627\u0644\u0646\u0633\u062e\u0629 \u0627\u0644\u0642\u0635\u064a\u0631\u0629<\/h2>\n

The famous claim that 60% of small businesses close after an attack has no verifiable source. The organisation credited with it has said so (National Cybersecurity Alliance, 2026).<\/p>\n

The measured figure is closer to 19%, from a survey of over 5,000 owners.<\/p>\n

The genuine finding is that ransomware appears in 88% of SMB breaches, against 39% at large organisations<\/strong> (Verizon, 2025).<\/p>\n

Small businesses are not targeted more. Attacks against them succeed more.<\/p>\n

Average downtime runs around 24 days, and downtime costs more than most ransoms.<\/p>\n

Four of the six most effective protections are free: MFA, updates, closing remote access, and a written plan.<\/p>\n

The fifth is one backup copy ransomware cannot reach. Test restoring it.<\/p>\n

And treat the myth at the top of this article as a lesson in itself.<\/p>\n

A frightening number repeated for fifteen years turned out to have no study behind it.<\/p>\n

Before acting on any alarming statistic, trace it back to whoever collected the data.<\/strong><\/p>\n

If every citation points to another article, you have found a rumour rather than a finding. \ud83d\udee1\ufe0f<\/p>\n

\ud83d\ude80 Browse Backup and Security Trials \u2192<\/a><\/p>\n

\u2753 \u0627\u0644\u0623\u0633\u0626\u0644\u0629 \u0627\u0644\u0645\u062a\u062f\u0627\u0648\u0644\u0629<\/h2>\n

Do 60% of small businesses really close after a cyberattack?<\/h3>\n

No. The National Cybersecurity Alliance has stated the figure did not come from their research and cannot be verified. Survey data puts it nearer 19%.<\/p>\n

Why is that number everywhere then?<\/h3>\n

It is memorable, alarming and useful to anyone selling security products. Each retelling cited the previous one rather than a study.<\/p>\n

Are small businesses really targeted more?<\/h3>\n

Ransomware appears in 88% of SMB breaches against 39% at large organisations. The difference is that attacks succeed more often, not that attackers choose them.<\/p>\n

How long does recovery take?<\/h3>\n

Average ransomware downtime is around 24 days, though prepared businesses recover far faster.<\/p>\n

What does an attack cost a small business?<\/h3>\n

Typically $120,000 to $1.24 million. Downtime usually costs more than the ransom itself.<\/p>\n

Should we pay the ransom?<\/h3>\n

Law enforcement advises against it. Payment buys a tool from a criminal with no guarantee, and does not stop stolen data being published.<\/p>\n

What is the cheapest effective protection?<\/h3>\n

Multi-factor sign-in on email and remote access. It is free and blocks the most common entry route.<\/p>\n

Why do backups fail when needed?<\/h3>\n

Usually because nobody tested a restore, or the backup drive was connected and got encrypted too.<\/p>\n

Are we too small to be a target?<\/h3>\n

No. Most ransomware arrives through automated scanning rather than selection, and around 43% of attacks hit small and mid-sized businesses (Astra, 2026).<\/p>\n

What should we do in the first hour?<\/h3>\n

Disconnect affected machines from the network but do not power them off, since that destroys evidence. Then check backups and notify your insurer.<\/p>\n

Why does downtime cost more than the ransom?<\/h3>\n

Average downtime runs around 24 days. Revenue stops while wages and rent continue, and that gap is what closes businesses.<\/p>\n

Does being a supplier increase our risk?<\/h3>\n

Yes. Small firms are attacked as a route into larger customers, which is why big companies now ask suppliers about their security.<\/p>\n

Does cyber insurance cover this?<\/h3>\n

Increasingly only if you had MFA and tested backups in place. Read the conditions before assuming cover.<\/p>\n

\ud83d\udcda \u0627\u0644\u0645\u0631\u0627\u062c\u0639<\/h2>\n

National Cybersecurity Alliance. (2026). Statement regarding incorrect small business statistic<\/em>. \u062a\u0645 \u0627\u0644\u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0641\u064a 8 \u0623\u063a\u0633\u0637\u0633 2026 \u0645\u0646 https:\/\/www.staysafeonline.org\/press\/national-cyber-security-alliance-statement-regarding-incorrect-small-business-statistic<\/a><\/p>\n

Verizon. (2025). Data breach investigations report<\/em>, cited in Huntress ransomware statistics. Retrieved August 8, 2026, from https:\/\/www.huntress.com\/ransomware-guide\/ransomware-attack-statistics<\/a><\/p>\n

Astra. (2026). Small business cyber attack statistics<\/em>. \u062a\u0645 \u0627\u0644\u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0641\u064a 8 \u0623\u063a\u0633\u0637\u0633 2026 \u0645\u0646 https:\/\/www.getastra.com\/blog\/security-audit\/small-business-cyber-attack-statistics\/<\/a><\/p>\n

SQ Magazine. (2026). Small business cybersecurity statistics: threats and costs<\/em>. \u062a\u0645 \u0627\u0644\u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0641\u064a 8 \u0623\u063a\u0633\u0637\u0633 2026 \u0645\u0646 https:\/\/sqmagazine.co.uk\/small-business-cybersecurity-statistics\/<\/a><\/p>\n

SC World. (2026). Most small businesses survive data breaches<\/em>. \u062a\u0645 \u0627\u0644\u0627\u0633\u062a\u0631\u062c\u0627\u0639 \u0641\u064a 8 \u0623\u063a\u0633\u0637\u0633 2026 \u0645\u0646 https:\/\/www.scworld.com\/news\/most-small-businesses-survive-data-breaches-heres-how-to-make-sure-yours-does-too<\/a><\/p>\n

\u0627\u0644\u0642\u0631\u0627\u0621\u0629 \u0630\u0627\u062a \u0627\u0644\u0635\u0644\u0629 \u0639\u0644\u0649 \u0647\u0630\u0627 \u0627\u0644\u0645\u0648\u0642\u0639<\/h3>\n

\u0644\u062f\u064a\u0646\u0627 password and MFA research<\/a> covers the most common entry route in detail. See also our \u062a\u062d\u0644\u064a\u0644 \u062a\u0643\u0644\u0641\u0629 \u0627\u0644\u0627\u0646\u062a\u0647\u0627\u0643<\/a> for what follows an incident, and the \u062f\u0644\u064a\u0644 \u062a\u062c\u0631\u064a\u0628\u064a \u0645\u062c\u0627\u0646\u064a \u0645\u0646 \u0627\u0644\u062f\u0627\u062e\u0644<\/a> for backup and security trials.<\/p>\n

\u062d\u0648\u0644 \u0647\u0630\u0627 \u0627\u0644\u062a\u062d\u0644\u064a\u0644<\/h3>\n

\u062a\u0635\u062d\u062d \u0647\u0630\u0647 \u0627\u0644\u0645\u0642\u0627\u0644\u0629 \u0625\u062d\u0635\u0627\u0626\u064a\u0629 \u062a\u062a\u0643\u0631\u0631 \u0639\u0628\u0631 \u0645\u0639\u0638\u0645 \u0627\u0644\u062a\u063a\u0637\u064a\u0627\u062a \u0627\u0644\u0645\u062a\u0646\u0627\u0641\u0633\u0629\u060c \u0648\u0630\u0644\u0643 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u062a\u0646\u0635\u0644 \u0627\u0644\u0630\u064a \u062a\u0646\u0634\u0631\u0647 \u0627\u0644\u0645\u0646\u0638\u0645\u0629 \u0627\u0644\u062a\u064a \u064a\u064f\u0646\u0633\u0628 \u0625\u0644\u064a\u0647\u0627 \u0627\u0644\u0641\u0636\u0644 \u0639\u0627\u062f\u0629\u064b. \u0648\u062d\u064a\u062b\u0645\u0627 \u062a\u0648\u062c\u062f \u0623\u0631\u0642\u0627\u0645 \u062f\u0642\u064a\u0642\u0629 \u064a\u062a\u0645 \u0627\u0633\u062a\u062e\u062f\u0627\u0645\u0647\u0627 \u0628\u062f\u0644\u0627\u064b \u0645\u0646 \u0630\u0644\u0643\u060c \u0645\u0639 \u0630\u0643\u0631 \u0645\u0635\u0627\u062f\u0631\u0647\u0627. \u064a\u062a\u0645 \u0646\u0634\u0631 \u0627\u0644\u0643\u062b\u064a\u0631 \u0645\u0646 \u0627\u0644\u0623\u0628\u062d\u0627\u062b \u0641\u064a \u0647\u0630\u0647 \u0627\u0644\u0641\u0626\u0629 \u0645\u0646 \u0642\u0628\u0644 \u0627\u0644\u0628\u0627\u0626\u0639\u064a\u0646 \u0627\u0644\u0623\u0645\u0646\u064a\u064a\u0646\u060c \u062d\u064a\u062b \u064a\u062f\u0639\u0645 \u0627\u0644\u062e\u0648\u0641 \u0627\u0644\u0645\u0628\u064a\u0639\u0627\u062a\u060c \u0648\u0647\u0630\u0627 \u0645\u0639\u0644\u0646 \u0648\u0644\u064a\u0633 \u0645\u062e\u0641\u064a\u064b\u0627. \u062a\u0645 \u0641\u062d\u0635 \u0627\u0644\u0623\u0631\u0642\u0627\u0645 \u0641\u064a 8 \u0623\u063a\u0633\u0637\u0633 2026.<\/p>","protected":false},"excerpt":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack. It appears everywhere. […]<\/p>\n","protected":false},"author":1,"featured_media":5403,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_kadence_starter_templates_imported_post":false,"footnotes":""},"categories":[40],"tags":[],"class_list":["post-5404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ecommerce-reviews"],"_links":{"self":[{"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/posts\/5404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/comments?post=5404"}],"version-history":[{"count":1,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/posts\/5404\/revisions"}],"predecessor-version":[{"id":5466,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/posts\/5404\/revisions\/5466"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/media\/5403"}],"wp:attachment":[{"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/media?parent=5404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/categories?post=5404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yamuparkoti.com\/ar\/wp-json\/wp\/v2\/tags?post=5404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}