Cyberattacks Are Hitting Small Businesses Where It Hurts Most: Customer Data and Cash
Cybercriminals are going straight for the two things small businesses can least afford to lose: customer data and cash. A Kaspersky survey shows how common the attacks are across Asia-Pacific.
In the survey of IT and IT security professionals, 87% of respondents in the region’s small and medium-sized business sector reported at least one cyber incident in the year before the survey. The survey focused on companies with fewer than 500 employees.
Customer Data Is Top Target
Among Asia-Pacific (APAC) businesses hit by an incident, the most harmful attacks led to the theft of clients’ personal data (25%). Disruption of client-facing services, such as websites and online stores, and theft of employees’ personal data each followed at 23%.
Stealing clients’ personal data was also the leading objective for attackers in APAC, at 34%. Sensitive internal information, such as financial credentials and legal documents, followed at 31%, then employees’ personal data at 27%.
Blocking employees and clients from online resources was cited by 23% of respondents. Kaspersky said the pattern reflects a strategic shift toward extracting data that can be monetized or used for further attacks.
Lasting Damage and Defense Moves
The damage can be permanent. The survey found that 21% of companies reported financial loss and an equal share faced irrecoverable data loss, while 13% suffered irreversible damage to corporate assets.
Software vulnerability exploits (10%), mass malware attacks (7%) and external remote access (7%) were the threats cited as most damaging. IT and IT security teams were the most targeted, with 51% and 52% of the most harmful attacks, respectively.
Smaller firms feel the hit hardest. “Cyber incidents often inflict far more devastating consequences on small and medium-sized companies than high-profile breaches do on large corporations,” said Ilya Markelov, head of Unified Platform Product Line at Kaspersky.
Customer service (22%) and accounting and finance (20%) were the next most targeted departments. Breaches have also pushed companies to act, with IT security monitoring, cloud security controls and tougher third-party compliance requirements each cited by 24%.
Specialized IT staff training, security software on all employee devices, revised password policies and multi-factor authentication each followed at 22%. Kaspersky also recommends strict access controls, daily backups and continuous employee training.
Adrian Hia, Kaspersky’s managing director for Asia Pacific, said the risks reach beyond IT. “A single incident can compromise sensitive information, interrupt day-to-day operations and weaken customer trust,” he said.
- Cyberattacks Are Hitting Small Businesses Where It Hurts Most: Customer Data and Cash - October 28, 2026
- Reykjavik Named Europe’s Best City for Sleep as Experts Warn of Widespread Sleep Deprivation - October 20, 2026
- Future Quantum Computers Could Hijack VPN Sessions, Surfshark Warns - October 11, 2026
