Cyber Security for Small Businesses: The Five Attacks That Actually Happen

Nobody is sitting in a dark room picking out your café. Most attacks on UK small businesses are automated and sent in bulk, to catch whoever happens to click. The same phishing email costs a criminal nothing to send to fifty thousand inboxes at once, and that's a big part of why the government's Cyber Security Breaches Survey 2025/2026 found 46% of small businesses and 42% of micro businesses had a breach or attack in the past year. They don't care about your salon specifically, it just happened to be on the list.

Because the attacks are ordinary, the defences are ordinary too, and you don't need a security team to put them in place. A password manager, two-factor authentication, software that updates itself, a habit of ringing suppliers back and some backups will cover most of it. This article walks through the five attacks that actually happen to firms your size, what each one looks like when it happens to you, and the simple fix that stops it.

Why you're on the list at all

A lot of owners believe that being small means being invisible, but the survey data says otherwise, and it's easy to see why. Most attacks start with email sent to anyone and everyone. Small firms have the same inboxes as everyone else, but they rarely have the filtering, training or second pair of eyes that larger companies pay for. According to the same government survey, where a business suffered a breach, phishing was involved in around 85% of cases.

These emails already turn up in your inbox every week, in among the supplier emails and booking confirmations, so what matters is what happens when one of them lands on a busy Tuesday.

Attack one: the email that asks you to log in

This is the most common one. An email arrives that looks like it's from Microsoft 365, Google, your bank or Royal Mail, saying something needs your attention, such as a missed delivery, a suspended account or an invoice to review. The link goes to a login page that looks exactly like the real one. You type your email and password, the page shrugs or sends you on to the genuine site, and you forget about it.

The attacker doesn't forget, though. They now have your mailbox, and they tend to sit in it quietly for a while. They read your invoices, learn who your suppliers are and how you write, and wait for a good moment to use the access. That waiting is what makes the next attack on this list possible.

The simple defence is two-factor authentication (2FA, sometimes called MFA). With it switched on, a stolen password alone won't open your account. The survey found 43% of micro businesses now require it, up from 35% the year before, so most still don't. Turn it on for email first, since email can reset everything else, then your bank, then your accounting software. It takes about twenty minutes of mild annoyance, and you only have to do it once.

Attack two: the invoice with new bank details

Business email compromise is the one that empties bank accounts. It usually goes like this. An attacker has access to a mailbox, yours or a supplier's, and waits for a real invoice to be due. Then they send a follow-up from that account, or from a lookalike domain one letter off, saying the bank details have changed. The email mentions the real job, the real amount and the real names, so you pay it, and the money is gone within hours, often moved through several accounts before anyone notices.

This sits inside what UK Finance calls authorised push payment (APP) fraud, where the victim makes the transfer themselves. Its Annual Fraud Report 2025 puts APP losses at £450.7 million in 2024, within over £1.1 billion stolen through fraud overall. Reimbursement rules introduced in October 2024 returned £267.1 million to APP victims, about 59% of losses. That's better than nothing, but it still leaves a lot of businesses out of pocket and short of cash while their claims slowly work through.

The defence here costs one phone call. Any time bank details change, or a new large payee appears, ring the supplier on a number you already had, from their website or an earlier invoice, and never from the email asking for money. Confirm the details out loud. If you've already put some structure around invoicing and payments, the kind we covered in our piece on small business automation, add this as a fixed step, so payee details never change because of an email alone.

Attack three: the password you've used everywhere

Somewhere out there is a website you signed up to in 2014 that's since been breached. The email and password you used are now on a list that criminals trade, and there's software whose whole job is to try those pairs against every bank, email provider and shop login on the internet. It's called credential stuffing, it's fully automated, and it works because people reuse passwords.

Weak and reused passwords are very common, and there's plenty of evidence for it. An NCSC analysis of breached accounts found 23.2 million of them worldwide used "123456" as the password. If your Instagram password is the same as your email password and your bank password, one breach anywhere becomes a breach everywhere.

The fix is a password manager. It makes a different strong password for every account and remembers them all, so you only need to remember one. For that one master password, the NCSC suggests three random words, which is better than any clever swapping of letters for numbers. While you're at it, put your email address into haveibeenpwned.com. It'll tell you which old breaches you appear in, and which passwords to retire today.

Attack four: ransomware through the update you skipped

Ransomware rarely gets in through anything clever. It usually comes through a known hole in software that had a fix published months earlier, such as an old remote access tool, an unpatched router or a website plugin nobody has touched since the site launched. Automated scanners search the internet for these holes all the time. Once inside, the attacker encrypts everything they can reach, deletes any backups connected to the network and leaves a ransom note.

The breaches survey records ransomware hitting around 1% of UK businesses this year, down from 3% the year before, so it's rare compared with phishing. When it does happen, though, it can mean the till won't open at all. A café that loses its mailbox is annoyed, but a trades firm that loses every quote, job record and invoice from the last five years may not recover.

There are two simple defences. First, turn on automatic updates everywhere: Windows or macOS, your phones, your website's platform and plugins, and the router firmware if your IT person can manage it. Second, keep a backup that ransomware can't reach, either a proper cloud backup service or a drive that isn't plugged in all the time. Both are in the NCSC's Small Business Guide, which covers its five basics (backups, malware protection, device security, passwords, phishing) in less than an hour of reading.

Attack five: card skimming on your online shop

If you sell online, there's a fifth attack, and this one is aimed at your customers' cards rather than your bank account. Criminals break into the website itself, usually through an outdated plugin or theme, and add a small piece of JavaScript to the checkout page. It copies card numbers as customers type them and sends them off, while the order goes through as normal. Nothing looks wrong to you or the customer, sometimes for months.

This technique, often grouped under the name Magecart, is what hit British Airways in 2018, exposing the card details of over 400,000 customers and earning the airline a £20 million fine from the ICO. The same scripts get planted on small WooCommerce and Magento shops all the time, and the criminals don't mind whether the checkout sells flights or candles.

The best defence is to avoid handling card data at all. Use a hosted checkout, the kind Stripe, PayPal, Shopify and Square provide, where the customer enters their card details on the provider's secure page instead of yours. Then keep the shop's platform and plugins updated, as in attack four, because a skimmer still needs a way in to redirect customers in the first place.

Cyber Essentials: the structured next step

Once the basics above are in place, Cyber Essentials is a sensible way to make them stick. It's a government-backed certification, run by IASME for the NCSC, covering five technical controls: firewalls, secure configuration, who has access to what, malware protection and security updates. You fill in a self-assessment questionnaire and a qualified assessor checks it.

It doesn't cost much. IASME's tiered pricing puts the basic certification at £320 + VAT for micro businesses (0–9 employees) and £440 + VAT for small ones (10–49). That fee includes cyber liability insurance for UK organisations with under £20 million turnover. The hands-on version, Cyber Essentials Plus, where an assessor actually tests your setup, costs about £1,500–£1,900 + VAT for firms this size.

As well as the security itself, the badge matters more and more when you're winning work. Public sector contracts often require it, and larger customers ask for it in supplier questionnaires. Few of the firms that would gain most from it have even heard of it, though. The breaches survey found only 14% of micro businesses and 25% of small ones knew about the scheme, so holding it can quietly set you apart.

The first hour after you realise something's wrong

At some point something will get through, so it's worth knowing what to do in the first hour before you ever need it.

1. Contain it. Disconnect the affected machine from the network and Wi-Fi. Don't wipe it, don't pay anything and don't delete the dodgy email, because you'll want the evidence.
2. Lock your accounts. From a different, clean device, change the passwords on email and banking, turn on 2FA if it somehow still isn't on, and sign out all active sessions (both Microsoft 365 and Google Workspace have a button for this).
3. Call your bank straight away if money has moved or bank details were involved. Be quick, because transfers can sometimes be frozen in the first few hours.
4. Report it. Action Fraud is the UK's reporting centre, online or on 0300 123 2040, and that same number runs a 24/7 line for businesses under live cyber attack. Significant incidents can also be reported to the NCSC, whose Small Business Guide to Response and Recovery is worth reading before you ever need it.
5. Consider the ICO. If personal data was exposed (customer details, staff records, your booking list) and there's a likely risk to the people involved, you must notify the ICO within 72 hours of becoming aware. Lower-risk incidents don't need reporting, but you must record them internally either way. We've covered where these duties come from in our plain-English guide to UK GDPR and the DUAA.

The cyber insurance question

Insurance is the last thing to sort out, once everything else is in place. The breaches survey found 55% of small businesses already have some form of cyber cover, often bundled into a broader policy, and many owners couldn't say what it actually pays for. Insurers will ask whether you use MFA, backups and updates before they'll quote, and a claim can fail if you said yes and the reality was no. A policy can pay for forensics, legal advice and customer notification after a bad incident, which is useful, but it won't recover your reputation or your lost week. So do the cheap defences in this article first. You'll likely find the premium gets cheaper too, and the Cyber Essentials route bundles basic liability cover into its £320 fee anyway.

What the five defences have in common

Look back at the five defences: a password manager, 2FA, automatic updates, a call-back rule and backups. None of them needs technical skill, a consultant or more than pennies in ongoing cost. They work because you do them the same way every time, just as the attacks arrive the same way every time. Criminals make their money from the thousands of firms that haven't spent the one afternoon all this takes. If you'd like to start, block out that afternoon in your diary and begin with 2FA on your email, since that protects everything else.

---

References

• Cyber Security Breaches Survey 2025/2026, GOV.UK
• Annual Fraud Report 2025, UK Finance
• Small Business Guide: Cyber Security, NCSC
• Most hacked passwords revealed as UK cyber survey exposes gaps in online security, NCSC
• Cyber Essentials: Frequently Asked Questions, IASME
• 72 hours: how to respond to a personal data breach, ICO
• Reporting fraud and cyber crime, Action Fraud
• British Airways fined £20m for Magecart hack, The Register