{"id":5404,"date":"2026-09-12T09:00:00","date_gmt":"2026-09-12T09:00:00","guid":{"rendered":"https:\/\/yamuparkoti.com\/?p=5404"},"modified":"2026-08-21T19:38:26","modified_gmt":"2026-08-21T19:38:26","slug":"ransomware-xiao-qiye-data","status":"publish","type":"post","link":"https:\/\/yamuparkoti.com\/zh\/ransomware-small-business-data\/","title":{"rendered":"Ransomware and Small Business: The Real Numbers"},"content":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack<\/strong>.<\/p>\n

It appears everywhere. News outlets, vendor pages, government talks, conference slides.<\/p>\n

There is one problem with it.<\/p>\n

It is not true, and the organisation usually credited with it has publicly said so.<\/strong><\/p>\n

The National Cybersecurity Alliance issued a statement confirming the figure did not come from their research and that they cannot verify its source (National Cybersecurity Alliance, 2026).<\/p>\n

So let us look at what the real numbers say instead. \ud83d\udee1\ufe0f<\/p>\n

\ud83c\udf81 Compare Backup and Security Trials \u2192<\/a><\/p>\n

\ud83e\uddfe \u4e3b\u8981\u53d1\u73b0\u6982\u89c8<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
\u63aa\u65bd<\/th>\n\u6570\u5b57<\/th>\n\u6765\u6e90<\/th>\n<\/tr>\n<\/thead>\n
The famous “60% close” figure<\/td>\nUnverified, disavowed<\/strong><\/td>\nNational Cybersecurity Alliance (2026)<\/td>\n<\/tr>\n
SMBs going out of business after an attack<\/td>\nAbout 19%<\/strong><\/td>\nMastercard survey, cited 2026<\/td>\n<\/tr>\n
Cyberattacks aimed at SMBs<\/td>\nAbout 43%<\/td>\nAstra (2026)<\/td>\n<\/tr>\n
Ransomware present in SMB breaches<\/td>\n88%<\/strong><\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Same figure at large organisations<\/td>\n39%<\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Average ransomware downtime<\/td>\nAbout 24 days<\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Recovery cost, excluding ransom<\/td>\n$1.53 million average<\/strong><\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Typical small business range<\/td>\n$120,000 to $1.24 million<\/td>\nSQ Magazine (2026)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\"Ransomware<\/p>\n

\ud83e\udddf The Statistic That Refuses to Die<\/h2>\n

This deserves proper attention, because it shapes how people think about the whole topic.<\/p>\n

The 60% claim first appeared around 2011.<\/p>\n

It has been repeated for roughly fifteen years without anyone producing the underlying study.<\/p>\n

What the NCSA actually said<\/h3>\n

The National Cybersecurity Alliance is the body most often credited with the figure.<\/p>\n

They published a statement noting the statistic was not generated from their research.<\/p>\n

They also confirmed they cannot verify its original source.<\/strong><\/p>\n

They stopped using it in their own materials.<\/p>\n

Why it spread so effectively<\/h3>\n

It is memorable, alarming and useful to anyone selling security products.<\/p>\n

Each retelling cited the previous one rather than any primary source.<\/p>\n

After enough repetitions, it looked like established fact.<\/p>\n

\n

\ud83d\udcca The myth against the measured figure<\/p>\n

\n\n\n60%<\/text>\nWidely repeated claim<\/text>\nunverified<\/text>\n\n19%<\/text>\nMeasured in survey<\/text>\n5,000+ owners<\/text>\nSources: National Cybersecurity Alliance (2026) disavowal; Mastercard survey, cited 2026.<\/text>\n<\/svg>\n<\/div>\n

What the real number appears to be<\/h3>\n

A Mastercard survey covered more than 5,000 small business owners. Almost one in five who suffered an attack went out of business.<\/p>\n

That is roughly 19%, not 60%.<\/p>\n

Still serious. Still a fifth of affected businesses. But a third of the claim.<\/strong><\/p>\n

Why the correction matters<\/h3>\n

Inflated statistics do not make people safer.<\/p>\n

They make the problem feel unsurvivable, which encourages fatalism rather than action.<\/p>\n

And when someone discovers one figure was invented, they discount the accurate ones too.<\/p>\n

\ud83d\udd0e Try Backup Tools Free \u2192<\/a><\/p>\n

\ud83c\udfaf Why Small Businesses Are Targeted<\/h2>\n

The genuine finding here is stark, and better evidenced than the myth.<\/p>\n

Ransomware was present in 88% of breaches at small and mid-sized businesses<\/strong> (Verizon, 2025).<\/p>\n

At large organisations the figure was 39%.<\/p>\n

More than double the rate.<\/p>\n

\n

\ud83d\udcca Ransomware present in breaches, by organisation size<\/p>\n

\n\n\n88%<\/text>\nSmall and mid-sized<\/text>\n\n39%<\/text>\nLarge organisations<\/text>\nSource: Verizon Data Breach Investigations Report (2025).<\/text>\n<\/svg>\n<\/div>\n

Why the gap exists<\/h3>\n

Large organisations have security teams, tested backups and incident plans.<\/p>\n

They still get attacked, but ransomware succeeds less often.<\/p>\n

Small businesses are not attacked more because they are chosen. They are attacked more because attacks succeed.<\/strong><\/p>\n

The automation point<\/h3>\n

Most ransomware is not targeted at a specific company.<\/p>\n

Automated tools scan for known weaknesses across the whole internet.<\/p>\n

Being small does not make you invisible. It often makes you easier.<\/p>\n

\u23f1\ufe0f What an Attack Actually Costs<\/h2>\n

The financial figures are wide, and the reason is worth knowing.<\/p>\n\n\n\n\n\n\n\n\n\n
Cost element<\/th>\nTypical scale<\/th>\n<\/tr>\n<\/thead>\n
Downtime<\/td>\nAround 24 days on average<\/strong><\/td>\n<\/tr>\n
Recovery excluding ransom<\/td>\n$1.53 million average<\/td>\n<\/tr>\n
Small business range<\/td>\n$120,000 to $1.24 million<\/strong><\/td>\n<\/tr>\n
Ransom itself<\/td>\nHighly variable, often not the largest cost<\/td>\n<\/tr>\n
Lost customers<\/td>\nRuns long after recovery<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Note that the ransom is rarely the biggest line.<\/p>\n

Twenty-four days of downtime destroys more value than most ransom demands.<\/strong><\/p>\n

Why downtime dominates<\/h3>\n

A business that cannot invoice, deliver or answer customers for three weeks is in serious trouble.<\/p>\n

Staff still get paid. Rent still falls due.<\/p>\n

Revenue stops while costs continue, and that gap is what closes companies.<\/p>\n

The range tells you something<\/h3>\n

$120,000 to $1.24 million is an enormous spread.<\/p>\n

The difference is almost entirely preparation.<\/p>\n

Businesses with tested backups recover in days. Those without recover in weeks or never.<\/p>\n

\ud83d\udcca Where the Money Actually Goes<\/h2>\n

Splitting the cost shows why preparation changes the outcome so much.<\/p>\n

\n

\ud83e\udd67 Typical ransomware cost breakdown<\/p>\n

\n\n\n\n\ntotal cost<\/text>\nDowntime and lost revenue<\/text>\nRecovery and IT work<\/text>\nLegal, notification, advice<\/text>\nRansom, where paid<\/text>\nIndicative split. Downtime dominates (Huntress, 2026).<\/text>\n<\/svg>\n<\/div>\n

Notice how small the ransom slice is.<\/p>\n

Most of the damage happens while the business cannot operate.<\/strong><\/p>\n

Why that changes what to spend on<\/h3>\n

If downtime is the main cost, the main defence is fast recovery.<\/p>\n

That means tested backups, not just more prevention tools.<\/p>\n

A business that restores in two days avoids most of the loss (SQ Magazine, 2026).<\/p>\n

The sectors that suffer longest<\/h3>\n

Recovery times vary widely by industry.<\/p>\n

Manufacturing tends to be slowest, because physical processes stop.<\/p>\n

Financial firms recover fastest, largely because they rehearse it (Huntress, 2026).<\/p>\n

\ud83d\udcbe Why Backups Are the Whole Game<\/h2>\n

Ransomware works by making your data unavailable.<\/p>\n

A working backup makes that threat far weaker.<\/p>\n

But most backup setups fail at the moment they are needed.<\/p>\n\n\n\n\n\n\n\n\n\n
Common failure<\/th>\nWhy it happens<\/th>\n<\/tr>\n<\/thead>\n
Backup was never tested<\/td>\nNobody tried restoring<\/strong><\/td>\n<\/tr>\n
Backup drive was connected<\/td>\nEncrypted along with everything else<\/td>\n<\/tr>\n
Backup stopped months ago<\/td>\nFailure alerts ignored<\/td>\n<\/tr>\n
Only some data covered<\/td>\nNobody audited what was included<\/td>\n<\/tr>\n
Restore takes too long<\/td>\nTechnically works, practically useless<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The second row catches many businesses.<\/p>\n

A backup drive left plugged in gets encrypted with the rest.<\/strong><\/p>\n

The rule that works<\/h3>\n

Keep at least one backup copy disconnected or immutable.<\/p>\n

Cloud backups with versioning handle this well, since older versions survive.<\/p>\n

The principle is simple: ransomware should not be able to reach every copy.<\/p>\n

Test the restore, not the backup<\/h3>\n

This is the step nearly everyone skips.<\/p>\n

A backup that runs successfully is not proof you can recover.<\/p>\n

Restore a few real files, quarterly. It takes fifteen minutes.<\/p>\n

Keep one backup off the domain<\/h3>\n

Attackers who gain administrator access often target backup systems first.<\/p>\n

A backup managed by the same credentials as everything else can be deleted with everything else.<\/p>\n

At least one copy should be outside that control, with separate credentials.<\/strong><\/p>\n

Know your restore time<\/h3>\n

Ask how long a full restore would actually take.<\/p>\n

If the answer is a week, that is a week of downtime you have already accepted.<\/p>\n

\u6211\u4eec\u7684 breach cost analysis<\/a> covers why time dominates every cost calculation.<\/p>\n

\ud83d\udeaa How Ransomware Gets In<\/h2>\n

The entry routes are unglamorous and mostly preventable.<\/p>\n\n\n\n\n\n\n\n\n\n
\u8def\u7ebf<\/th>\n\u9884\u9632<\/th>\n<\/tr>\n<\/thead>\n
Stolen or reused credentials<\/td>\nMulti-factor sign-in<\/strong><\/td>\n<\/tr>\n
Phishing email<\/td>\nStaff awareness, email filtering<\/td>\n<\/tr>\n
Unpatched software<\/td>\nAutomatic updates<\/td>\n<\/tr>\n
Exposed remote access<\/td>\nClose it or put it behind MFA<\/strong><\/td>\n<\/tr>\n
Compromised supplier<\/td>\nHarder \u2014 ask about their security<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of five are addressable without much budget.<\/p>\n

\u6211\u4eec\u7684 password research<\/a> shows MFA cut account compromise by over 99%.<\/p>\n

Remote access is the quiet one<\/h3>\n

Many small businesses expose remote desktop access to the internet.<\/p>\n

It is convenient, and automated scanners find it within hours.<\/p>\n

If you need remote access, it should sit behind MFA at minimum.<\/p>\n

Updates matter more than antivirus<\/h3>\n

Most successful attacks use weaknesses that were already patched.<\/p>\n

The patch existed. Nobody applied it.<\/p>\n

Automatic updates are free and prevent more than most paid products.<\/strong><\/p>\n

\ud83d\udcb8 The Ransom Question<\/h2>\n

If it happens, should you pay? The honest answer is layered.<\/p>\n

Law enforcement generally advises against it.<\/p>\n

Payment funds further attacks and marks you as willing to pay.<\/p>\n

What payment does not buy<\/h3>\n

It buys a decryption tool, from a criminal, with no guarantee.<\/p>\n

Recovery after payment is often partial and slow.<\/p>\n

And modern attacks steal data before encrypting, so payment does not prevent publication.<\/p>\n

Why that last point changed everything<\/h3>\n

Ransomware used to be about locking files.<\/p>\n

Now a large share of attacks also threaten to publish stolen data.<\/p>\n

Backups solve the encryption problem but not the publication problem.<\/strong><\/p>\n

\u5b9e\u9645\u610f\u4e49<\/h3>\n

\u9884\u9632\u6bd4\u4ee5\u524d\u66f4\u91cd\u8981\u4e86\uff0c\u56e0\u4e3a\u8865\u6551\u63aa\u65bd\u7684\u4f5c\u7528\u6bd4\u4ee5\u524d\u5c0f\u4e86\u3002<\/p>\n

A perfect backup no longer makes you immune, only resilient.<\/p>\n

\ud83e\uddfe Which Small Businesses Get Hit Hardest<\/h2>\n

Exposure is not evenly spread, and the pattern is predictable.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u56e0\u7d20<\/th>\nRaises risk?<\/th>\n\u4e3a\u4ec0\u4e48<\/th>\n<\/tr>\n<\/thead>\n
Holding customer payment data<\/td>\n\u662f\u7684<\/strong><\/td>\nHigher value to attackers<\/td>\n<\/tr>\n
Remote access exposed online<\/td>\n\u662f\u7684<\/td>\nFound by automated scanners<\/td>\n<\/tr>\n
Older unsupported software<\/td>\nYes, strongly<\/strong><\/td>\nKnown weaknesses never patched<\/td>\n<\/tr>\n
Supplier to larger firms<\/td>\n\u662f\u7684<\/td>\nA route into bigger targets<\/td>\n<\/tr>\n
No dedicated IT support<\/td>\n\u662f\u7684<\/td>\nNobody watching for signs<\/td>\n<\/tr>\n
Regulated sector<\/td>\nCost, not likelihood<\/td>\nFines and notification duties<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The supplier row deserves attention, because it surprises people.<\/p>\n

A small firm can be attacked as a route into its largest customer.<\/strong><\/p>\n

That is why big companies increasingly ask suppliers about their security.<\/p>\n

The unsupported software problem<\/h3>\n

Software past end of life stops receiving fixes entirely.<\/p>\n

Every weakness found after that date stays open permanently.<\/p>\n

Automated scanners specifically look for these versions (Astra, 2026).<\/p>\n

Being a supplier changes your obligations<\/h3>\n

Larger customers may require evidence of controls before renewing contracts.<\/p>\n

That turns security from a cost into a condition of trading.<\/p>\n

Many small firms first take it seriously when a customer asks.<\/p>\n

\ud83d\udccb What a Small Business Should Actually Do<\/h2>\n

Ranked by protection per pound spent.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u884c\u52a8<\/th>\n\u6210\u672c<\/th>\nEffect<\/th>\n<\/tr>\n<\/thead>\n
MFA on email and remote access<\/td>\n\u81ea\u7531\u7684<\/strong><\/td>\nBlocks the most common entry<\/td>\n<\/tr>\n
Automatic updates everywhere<\/td>\n\u81ea\u7531\u7684<\/td>\nCloses known weaknesses<\/td>\n<\/tr>\n
One offline or immutable backup<\/td>\n\u4f4e\u7684<\/td>\nSurvives encryption<\/strong><\/td>\n<\/tr>\n
Quarterly restore test<\/td>\n15\u5206\u949f<\/td>\nProves the backup works<\/td>\n<\/tr>\n
Close unused remote access<\/td>\n\u81ea\u7531\u7684<\/td>\nRemoves a scanned target<\/td>\n<\/tr>\n
\u5355\u9875\u4e8b\u4ef6\u8ba1\u5212<\/td>\nAn hour<\/td>\nSaves days of confusion<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of six cost nothing at all.<\/p>\n

The gap between prepared and unprepared businesses is mostly attention, not budget.<\/strong><\/p>\n

\u6ca1\u4eba\u5199\u7684\u5e94\u6025\u9884\u6848<\/h3>\n

Three questions on one page. Who decides? Who calls the insurer or lawyer? Who tells customers?<\/p>\n

Deciding that during an incident costs days.<\/p>\n

Deciding it in advance costs an hour.<\/p>\n

Train staff on one thing, not everything<\/h3>\n

Security awareness training often tries to cover too much and lands nowhere.<\/p>\n

Pick the single behaviour that matters most: report anything suspicious immediately, without blame.<\/p>\n

Most incidents are noticed by an ordinary employee before any system flags them.<\/strong><\/p>\n

If people fear being blamed, they stay quiet, and hours are lost.<\/p>\n

Cyber insurance, briefly<\/h3>\n

Policies increasingly require MFA and tested backups before paying out.<\/p>\n

Read those conditions before assuming you are covered.<\/p>\n

An insurer can decline if the required controls were not in place.<\/p>\n

\ud83d\udea8 The First Hour, If It Happens<\/h2>\n

Most damage in the early stage comes from panic rather than the attack itself.<\/p>\n

Knowing the sequence in advance is worth more than any single tool.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Order<\/th>\n\u884c\u52a8<\/th>\n\u4e3a\u4ec0\u4e48<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nDisconnect affected machines from the network<\/strong><\/td>\nStops spread<\/td>\n<\/tr>\n
2<\/td>\nDo not power them off<\/td>\nPreserves evidence in memory<\/td>\n<\/tr>\n
3<\/td>\nCheck whether backups are reachable<\/td>\nDetermines your options<\/td>\n<\/tr>\n
4<\/td>\nNotify insurer and legal contact<\/td>\nPolicies often require early notice<\/strong><\/td>\n<\/tr>\n
5<\/td>\nStart a written timeline<\/td>\nRegulators will ask<\/td>\n<\/tr>\n
6<\/td>\nDecide who speaks to customers<\/td>\nPrevents mixed messages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Row two is counterintuitive and frequently got wrong.<\/p>\n

Powering a machine off destroys evidence that helps investigators understand what happened.<\/strong><\/p>\n

Why the insurer comes early<\/h3>\n

Many policies require notification within a short window.<\/p>\n

Some also require you to use their approved responders.<\/p>\n

Calling your own specialist first can jeopardise the claim.<\/p>\n

The notification clock<\/h3>\n

If personal data was involved, regulators often require reporting within 72 hours of discovery.<\/p>\n

That clock starts when you find out, not when you finish investigating.<\/p>\n

\u6211\u4eec\u7684 breach cost analysis<\/a> covers how that timing drives cost.<\/p>\n

Write it down as you go<\/h3>\n

Memory degrades fast during an incident.<\/p>\n

A simple timestamped log answers most later questions from insurers and regulators.<\/p>\n

It costs nothing and is almost never done.<\/p>\n

\ud83d\udd2c How Reliable Is This Data?<\/h2>\n\n\n\n\n\n\n\n\n
\u6765\u6e90<\/th>\n\u529b\u91cf<\/th>\nCaveat<\/th>\n<\/tr>\n<\/thead>\n
Verizon DBIR<\/td>\nLong-running, consistent method<\/strong><\/td>\nReported incidents only<\/td>\n<\/tr>\n
Mastercard SMB survey<\/td>\n5,000+ owners<\/td>\nSelf-reported<\/td>\n<\/tr>\n
Security vendor statistics<\/td>\nPractical detail<\/td>\nThey sell the solution<\/strong><\/td>\n<\/tr>\n
The 60% closure claim<\/td>\n\u6ca1\u6709\u4efb\u4f55<\/td>\nDisavowed by NCSA<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

That bottom row is the lesson of this article.<\/p>\n

How to check a scary statistic<\/h3>\n

Trace it back until you reach an organisation that collected data.<\/p>\n

If every citation points to another article, you have found a rumour.<\/p>\n

A statistic with no primary source is not a statistic.<\/strong><\/p>\n

Why undercounting is likely too<\/h3>\n

Many small businesses never report attacks.<\/p>\n

They pay quietly, or recover without telling anyone.<\/p>\n

So real attack rates are probably higher than reported figures, even as closure rates are lower than claimed.<\/p>\n

\ud83e\uddef Why “We Are Too Small to Target” Is Wrong<\/h2>\n

This belief is the single most common reason small businesses do nothing.<\/p>\n

It rests on a misunderstanding of how attacks actually work.<\/p>\n

Nobody chose you<\/h3>\n

Most ransomware arrives through automated scanning, not selection.<\/p>\n

Tools sweep the internet looking for exposed services and known weaknesses.<\/p>\n

The attacker often learns who you are only after getting in.<\/strong><\/p>\n

Small does not mean cheap to attack<\/h3>\n

Automation removed the cost of trying.<\/p>\n

Scanning a million addresses costs barely more than scanning a hundred.<\/p>\n

So there is no economic reason to skip small targets.<\/p>\n

What actually deters an automated attack<\/h3>\n

Not obscurity. Just being harder than the next result on the list.<\/p>\n

Patched software, MFA and no exposed remote access are usually enough.<\/p>\n

These attacks pursue the easiest available target, not the most valuable one.<\/p>\n

The 43% figure in context<\/h3>\n

Around 43% of cyberattacks are aimed at small and mid-sized businesses (Astra, 2026).<\/p>\n

That is close to half of all attacks hitting the segment least prepared for them.<\/p>\n

Obscurity has not protected anyone for at least a decade.<\/p>\n

\ud83d\udeab \u8fd9\u4e9b\u6570\u636e\u65e0\u6cd5\u544a\u8bc9\u4f60\u4ec0\u4e48<\/h2>\n

It does not predict your risk.<\/strong> Sector and exposure vary enormously.<\/p>\n

Survey data is self-reported.<\/strong> Owners may misremember causes.<\/p>\n

Unreported attacks are invisible.<\/strong> The true rate is likely higher.<\/p>\n

Cost ranges are extremely wide.<\/strong> Preparation drives most of the difference.<\/p>\n

Much research is vendor-published.<\/strong> Fear supports sales.<\/p>\n

\ud83c\udfc1 \u7b80\u77ed\u7248<\/h2>\n

The famous claim that 60% of small businesses close after an attack has no verifiable source. The organisation credited with it has said so (National Cybersecurity Alliance, 2026).<\/p>\n

The measured figure is closer to 19%, from a survey of over 5,000 owners.<\/p>\n

The genuine finding is that ransomware appears in 88% of SMB breaches, against 39% at large organisations<\/strong> (Verizon, 2025).<\/p>\n

Small businesses are not targeted more. Attacks against them succeed more.<\/p>\n

Average downtime runs around 24 days, and downtime costs more than most ransoms.<\/p>\n

Four of the six most effective protections are free: MFA, updates, closing remote access, and a written plan.<\/p>\n

The fifth is one backup copy ransomware cannot reach. Test restoring it.<\/p>\n

And treat the myth at the top of this article as a lesson in itself.<\/p>\n

A frightening number repeated for fifteen years turned out to have no study behind it.<\/p>\n

Before acting on any alarming statistic, trace it back to whoever collected the data.<\/strong><\/p>\n

If every citation points to another article, you have found a rumour rather than a finding. \ud83d\udee1\ufe0f<\/p>\n

\ud83d\ude80 Browse Backup and Security Trials \u2192<\/a><\/p>\n

\u2753 \u5e38\u89c1\u95ee\u9898<\/h2>\n

Do 60% of small businesses really close after a cyberattack?<\/h3>\n

No. The National Cybersecurity Alliance has stated the figure did not come from their research and cannot be verified. Survey data puts it nearer 19%.<\/p>\n

Why is that number everywhere then?<\/h3>\n

It is memorable, alarming and useful to anyone selling security products. Each retelling cited the previous one rather than a study.<\/p>\n

Are small businesses really targeted more?<\/h3>\n

Ransomware appears in 88% of SMB breaches against 39% at large organisations. The difference is that attacks succeed more often, not that attackers choose them.<\/p>\n

How long does recovery take?<\/h3>\n

Average ransomware downtime is around 24 days, though prepared businesses recover far faster.<\/p>\n

What does an attack cost a small business?<\/h3>\n

Typically $120,000 to $1.24 million. Downtime usually costs more than the ransom itself.<\/p>\n

Should we pay the ransom?<\/h3>\n

Law enforcement advises against it. Payment buys a tool from a criminal with no guarantee, and does not stop stolen data being published.<\/p>\n

What is the cheapest effective protection?<\/h3>\n

Multi-factor sign-in on email and remote access. It is free and blocks the most common entry route.<\/p>\n

Why do backups fail when needed?<\/h3>\n

Usually because nobody tested a restore, or the backup drive was connected and got encrypted too.<\/p>\n

Are we too small to be a target?<\/h3>\n

No. Most ransomware arrives through automated scanning rather than selection, and around 43% of attacks hit small and mid-sized businesses (Astra, 2026).<\/p>\n

What should we do in the first hour?<\/h3>\n

Disconnect affected machines from the network but do not power them off, since that destroys evidence. Then check backups and notify your insurer.<\/p>\n

Why does downtime cost more than the ransom?<\/h3>\n

Average downtime runs around 24 days. Revenue stops while wages and rent continue, and that gap is what closes businesses.<\/p>\n

Does being a supplier increase our risk?<\/h3>\n

Yes. Small firms are attacked as a route into larger customers, which is why big companies now ask suppliers about their security.<\/p>\n

Does cyber insurance cover this?<\/h3>\n

Increasingly only if you had MFA and tested backups in place. Read the conditions before assuming cover.<\/p>\n

\ud83d\udcda \u53c2\u8003\u8d44\u6599<\/h2>\n

National Cybersecurity Alliance. (2026). Statement regarding incorrect small business statistic<\/em>2026\u5e748\u67088\u65e5\u68c0\u7d22\u81ea https:\/\/www.staysafeonline.org\/press\/national-cyber-security-alliance-statement-regarding-incorrect-small-business-statistic<\/a><\/p>\n

Verizon. (2025). Data breach investigations report<\/em>, cited in Huntress ransomware statistics. Retrieved August 8, 2026, from https:\/\/www.huntress.com\/ransomware-guide\/ransomware-attack-statistics<\/a><\/p>\n

Astra. (2026). Small business cyber attack statistics<\/em>2026\u5e748\u67088\u65e5\u68c0\u7d22\u81ea https:\/\/www.getastra.com\/blog\/security-audit\/small-business-cyber-attack-statistics\/<\/a><\/p>\n

SQ Magazine. (2026). Small business cybersecurity statistics: threats and costs<\/em>2026\u5e748\u67088\u65e5\u68c0\u7d22\u81ea https:\/\/sqmagazine.co.uk\/small-business-cybersecurity-statistics\/<\/a><\/p>\n

SC World. (2026). Most small businesses survive data breaches<\/em>2026\u5e748\u67088\u65e5\u68c0\u7d22\u81ea https:\/\/www.scworld.com\/news\/most-small-businesses-survive-data-breaches-heres-how-to-make-sure-yours-does-too<\/a><\/p>\n

\u672c\u7ad9\u76f8\u5173\u9605\u8bfb<\/h3>\n

\u6211\u4eec\u7684 password and MFA research<\/a> covers the most common entry route in detail. See also our breach cost analysis<\/a> for what follows an incident, and the \u514d\u8d39\u8bd5\u7528\u4f1a\u5458\u76ee\u5f55<\/a> for backup and security trials.<\/p>\n

\u5173\u4e8e\u672c\u6b21\u5206\u6790<\/h3>\n

This article corrects a statistic repeated across most competing coverage, using the disavowal published by the organisation usually credited with it. Where accurate figures exist they are used instead, with their sources named. Much research in this category is published by security vendors, where fear supports sales, and that is stated rather than hidden. Figures were checked on August 8, 2026.<\/p>","protected":false},"excerpt":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack. It appears everywhere. […]<\/p>\n","protected":false},"author":1,"featured_media":5403,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_kadence_starter_templates_imported_post":false,"footnotes":""},"categories":[40],"tags":[],"class_list":["post-5404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ecommerce-reviews"],"_links":{"self":[{"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/posts\/5404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/comments?post=5404"}],"version-history":[{"count":1,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/posts\/5404\/revisions"}],"predecessor-version":[{"id":5466,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/posts\/5404\/revisions\/5466"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/media\/5403"}],"wp:attachment":[{"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/media?parent=5404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/categories?post=5404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yamuparkoti.com\/zh\/wp-json\/wp\/v2\/tags?post=5404"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}