Almost a quarter of IT decision makers within small businesses (24%) suspect their company has covered up at least one successful cyber attack against their business in the last year.

This is one of the findings of a study by IT privacy and security solutions provider, Appstractor. The Under Attack: Assessing the Struggle of UK SMBs Against Cyber Criminals report canvassed the views of 500 IT decision makers at small UK firms.

It found that the majority of such companies are ignoring GDPR risks seven months after the new rules were officially introduced. The results of the study point towards a culture of secrecy and lack of trust within some small businesses when it comes to dealing with cyber attacks, according to Appstractor.

A spokesperson for the company said: “It has long been thought that some businesses have been trying to bury the fact that they have suffered a successful cyber attack against their company, perhaps in an effort to avoid the bad publicity and potential loss of business.

“The Institute of Directors, for instance, has previously shared its opinion that this practice of secrecy has been going on for some time, while also accusing small businesses of not taking cyber security seriously.

“With small businesses facing an average of five attacks in the last 12 months, there is also the potential that some businesses could be failing to disclose multiple breaches. Several high profile cover-ups of cyber attacks have already been revealed in the last few years, perhaps most notably when it was revealed that Uber had concealed a massive hack involving the data of 57 million users and drivers.”

In that case, it was revealed the firm had actually paid hackers $100,000 (£76,529) to delete data and keep the breach quiet.

The spokesperson added: “While being associated with a cyber attack can be crippling for a business, if small businesses are in fact trying to keep attacks secret, they are playing an extremely dangerous game with their future – especially considering GDPR, which came into force earlier this year.

“That is not even considering the backlash a business would likely face if it was later revealed that they had covered up a successful cyber attack which had put their customers’ data at risk.”

Other key findings from the report include:

• 75% of small businesses are yet to update their cybersecurity policies since the introduction of the General Data Protection Regulation (GDPR) – while 20% of those, still haven’t even
reviewed their security policies.

• Nearly four in ten businesses (37%) would hand customer data over to police, the government, or security services without question if asked to do so.

• 52% of businesses think customer data should only be handed over in ‘extreme situations’ (e.g. if it related to terrorism).

• Only 30% of IT decision makers in UK businesses have a full grasp on the benefits of current cybersecurity software solutions.

• More than half (56%) of IT decision makers think cybersecurity software has fallen behind the complexity of threats faced by small businesses, especially when compared to the software available to larger businesses.

• 49% of IT decision makers in small businesses think flexible and remote working policies in their business has increased the chance of a cyber attack against their business.

• 53% of IT managers think employees should receive more cybersecurity training, but only 26% of businesses have introduced new training schemes.