An onslaught of cyber-attacks is leaving SMEs with hefty fines and uncertain futures, according to new figures from specialist insurer Hiscox, disrupting day-to-day operations and threatening the very survival of businesses. 

After surveying more than 5,700 companies around the world, Hiscox’s ninth annual Cyber Readiness Report found that over half (59%) of SMEs have experienced a cyber-attack in the last twelve months, with 57% saying at least one attack was a result of an AI-related vulnerability.

Despite almost three-quarters (71%) of firms carrying cyber insurance, the financial losses of these attacks can be crippling. 

A third (33%) of those hit by a data breach faced a fine in the aftermath big enough to impact the financial health of the business, while 30% reported a reduction in business performance indicators, such as share price, and 29% suffered increased costs associated with notifying affected customers.

The fallout doesn’t end there, however, with 44% of affected firms out of pocket as a result of payment diversion fraud, 32% seeing employees struggle with burnout following an attack, and 29% finding it hard to attract new business.

Following a year of high-profile cyber-attacks in the UK, Hiscox’s study also found that ransomware remains a major threat.

More than a quarter (27%) of polled businesses reported a ransomware incident in the past year, with 80% forced to pay their attackers in an attempt to recover or protect critical data.

However, only 60% successfully recovered all or part of their data as a result of paying out, and for almost a third (31%) of those who paid a ransom, the attackers went on to demand more money.  

With many governments, including in the UK, considering legal changes or reporting requirements around ransom payments, Hiscox found that 71% of those firms believe companies should be required to disclose such payouts.

Those supporting disclosure said that it would help authorities to respond to future ransomware attacks (52%), and give customers or stakeholders a clearer picture of a company’s financial health.

Rather than wait for regulators to catch up, SMEs are stepping up their cyber defences. Almost all (94%) plan to boost their investment in cybersecurity over the next year. 

Recommended reading

• One in Three UK SMEs Dismiss Cyber Insurance Despite High Risk
• Report: Cyber Breaches Are Tanking Share Prices
• Cyber-crime Costs to Hit $1.2tn in 2025, New Report Warns

Among those investments, 70% of businesses said they will extend the cyber training they provide to employees, 60% will hire additional staff to increase cyber resilience, and 54% said they will buy in new software to help identify and manage threats.

“No business, however small, can afford to underestimate the devastating impact a cyber-attack can have,” said Eddie Lamb, global head of cyber at Hiscox.

“The financial fall-out, from crippling fines to lost customers or soaring costs, can push even the most resilient business to the brink. 

“By taking active steps to safeguard their operations, small business owners can not only protect themselves but also contribute to the resilience of the broader business community.”