Cyber

Your Small Business Is a Bigger Cyber Target Than You Think

Nrip Mehta

Aug 14, 2026 4:00 PM IST

Category Cyber

“

Synopsis

Small businesses can be easy targets for cybercriminals. Learn how MFA, strong passwords, backups, employee training and access controls can reduce cyber risk.

Air Commodore Nrip Kumar Mehta VSM (Retd)

For many small-business owners, cyber security feels like a problem for banks, government departments and large corporations. After all, why would a criminal target a neighbourhood café, medical practice, retailer, trades business or small professional firm?

The uncomfortable answer is simple: because attacking a small business can be easier.

Small and medium-sized enterprises hold information that cybercriminals value, including customer details, invoices, payment records, employee information, passwords and access to online banking. However, many have limited IT support, outdated software, and employees who have received little or no cybersecurity training.

This combination makes cyber security for small businesses a matter of business survival, not merely an IT issue.

Why small businesses are attractive targets

Cybercriminals do not always select their victims individually. Many attacks are automated and launched against thousands of email addresses, websites and online accounts simultaneously.

The criminals are looking for whichever organisation has an unpatched system, a reused password or an employee who responds to a convincing phishing message. A business does not have to be prominent to become a victim; it only has to be vulnerable.

Small businesses can be particularly exposed because:

• One employee may have access to several important systems.
• Business and personal devices may be used interchangeably.
• Passwords may be shared among employees.
• Software updates may be postponed to avoid interrupting work.
• Former employees may retain access to company accounts.
• Invoices and payment instructions may be accepted without independent verification.
• Backups may exist but may never have been tested.
• Employees may not know how to identify or report a suspicious message.

The Australian Cyber Security Centre advises small businesses to begin with three fundamental measures: turn on multi-factor authentication (MFA), update software, and back up important information. These are relatively inexpensive steps, but together they can prevent or limit many common attacks.

One compromised account can affect the entire business.

An SME data breach does not necessarily begin with a sophisticated attack. It may start when an employee opens a fake invoice, enters a password on a fraudulent login page or approves an unexpected multi-factor authentication request.

Criminals can also use credentials stolen in an unrelated breach. If an employee has reused the same password across several services, attackers may test that password against the organisation’s email, cloud storage or accounting system. This is commonly known as credential stuffing.

Once inside an email account, a criminal may silently monitor conversations, study payment patterns and wait for an opportunity. A genuine invoice can then be altered so that the payment is transferred to the criminal’s bank account. Because the message appears within an existing email conversation, it may look completely authentic.

The consequences can extend well beyond the immediate financial loss. A serious small business cyber risk can include:

• Disruption to normal operations
• Loss or encryption of important business records
• Fraudulent payments
• Exposure of customer or employee information
• Costly technical investigation, safety audit and system restoration
• Legal and regulatory obligations
• Damage to customer confidence
• Loss of future business

For a small organisation operating with limited cash reserves, the combined cost can be extremely difficult to absorb.

The cheapest place to start

If a business can take only one immediate action, it should enable multi-factor authentication(MFA), particularly on email, banking, accounting, payroll, cloud storage and administrator accounts.

MFA requires an additional form of verification beyond a password. Therefore, even when a password has been stolen, it is more difficult for the criminal to enter the account. The Australian Cyber Security Centre describes MFA as one of the most effective cyber security measures available to business leaders.

Where possible, businesses should use an authenticator application, security key or another secure method rather than relying solely on SMS.

MFA should then be supported by several other affordable controls.

Seven practical steps for reducing small business cyber risk

1. Install updates promptly

Enable automatic updates for operating systems, applications, internet browsers, website software, security products and mobile devices. Updates frequently correct weaknesses that criminals already know how to exploit.

Replace devices and software that are no longer supported by their manufacturers.

2. Maintain reliable backups

Regularly back up critical files, customer records and business information. Keep at least one protected backup separate from the main system so that it cannot be altered or encrypted during an attack.

A backup is useful only if it can be restored. Test the recovery process periodically rather than discovering during an emergency that the backup is incomplete or unusable.

3. Use strong, unique passwords

Employees should not reuse passwords between business and personal accounts. A reputable password manager can generate and securely store long, unique passwords without requiring employees to remember every one.

Shared accounts should be avoided wherever possible. Each person should have an individual login so that access can be controlled, logged, and activity can be traced.

4. Limit access

Employees should receive only the access required for their work. Administrator privileges should be tightly controlled, and access should be reviewed whenever someone changes roles or leaves the organisation.

This limits the amount of information or number of systems that can be affected if one account is compromised.

5. Provide regular employee cyber training

Employee cyber training need not be expensive or highly technical. Short, repeated sessions can teach staff to:

• Recognise phishing emails and fake login pages.
• Question urgent or unusual payment requests
• Avoid opening unexpected attachments.
• Reject unexplained MFA prompts.
• Report mistakes immediately
• Verify changes to bank details through a trusted telephone number.

Training should create confidence, not fear. Employees who accidentally click on something suspicious must feel able to report it quickly. Early reporting can prevent a minor incident from becoming a major breach.

6. Verify financial requests separately

Any request to change bank details, make an urgent transfer or purchase gift cards should be confirmed through a separate communication channel.

Do not use the telephone number contained in the suspicious email. Call the supplier or colleague using a previously verified number.

7. Prepare a simple response plan

Every business should know:

• Who must be contacted when an incident occurs
• How affected accounts will be disabled?
• How systems and evidence will be preserved
• Who will communicate with customers and suppliers?
• When professional, regulatory or law-enforcement assistance may be required
• How operations will continue while systems are unavailable

The Office of the Australian Information Commissioner emphasises that a current data-breach response plan is critical for containing, assessing and managing an incident.

Does every small business need a cyber security employee?

Not necessarily.

Many small businesses do not require a full-time cyber security specialist. Routine protections can often be configured by a reliable IT service provider or managed-security provider.

However, outsourcing the technical work does not transfer the business owner’s responsibility. Owners should understand what is being protected, who can access their systems, whether backups are tested, and what support will be available during an incident.

Service providers should also be assessed carefully. They may have privileged access to several customers, making their own accounts attractive targets.

Privacy responsibilities still matter.

Not every Australian small business is automatically covered by the Privacy Act 1988. The OAIC explains that most businesses with annual turnover of $3 million or less are not covered, although important exceptions apply, including certain health service providers and businesses that trade in personal information.

Businesses covered by the Privacy Act may be required to notify affected individuals and the OAIC when a data breach is likely to cause serious harm.

Even where formal notification requirements do not apply, customers increasingly expect every organisation to handle their information responsibly.

Cyber insurance is not automatic protection.

Cyber insurance may assist with some investigation, recovery, legal and notification costs, but it is not a substitute for basic security.

Cover varies significantly between policies. Insurers may require evidence of controls such as MFA, backups, employee training, access management and an incident-response plan. Incorrect information in an application or failure to maintain required controls could affect a claim.

Businesses should confirm what their policy covers, what exclusions apply and what must be done immediately after an incident.

What happens next?

Cyber security services aimed at SMEs are likely to become more accessible and affordable. Managed protection, automated monitoring and government-supported education can help businesses that cannot maintain specialist internal teams.

Eligible Australian businesses with 19 or fewer full-time employees and a valid ABN may also be able to access the free Small Business Cyber Resilience Service delivered by IDCARE.

However, technology and external support cannot replace basic internal discipline. Owners must establish clear procedures, employees must understand them, and protective controls must be checked regularly.

The most dangerous assumption is not that an attack will happen. It is believing that the business is too small for anyone to try.

Frequently asked questions

What is the cheapest first step for a small business?

Enable multi-factor authentication(MFA) on all important accounts, beginning with email, banking, accounting, cloud storage and administrator accounts. Automatic updates and tested backups should follow immediately.

Do we need a dedicated IT security person?

Not necessarily. Many baseline protections can be automated or managed by a reputable external provider. However, someone within the business must remain responsible for checking that the protections are working.

Does cyber insurance automatically cover every cyber incident?

No. Cover depends on the policy, exclusions and compliance with required security controls. Businesses should review the policy carefully and confirm its requirements with the insurer or broker.

Case Study: One Shared Password, Two Fee Payments

A student applied for a law course after responding to a university advertisement. During subsequent email correspondence, he received fee-payment instructions from the university’s official email account and transferred the money to the bank account provided. When no receipt or admission confirmation arrived, he visited the university and discovered that its email account had been compromised. Cybercriminals had used the genuine account to send fraudulent payment instructions and divert the fees to their own bank account. The student was required to pay the university again and subsequently reported the fraud to the police, where the matter remains under investigation. The compromised email account was reportedly being accessed by four employees using a shared password, without multi-factor authentication, demonstrating how weak credential practices can expose an organisation and its customers to serious financial loss.

In business, as on the battlefield, the smallest unguarded opening can invite the greatest damage; cyber vigilance must remain your first line of defence.