TL;DR

Ransomware now hits SMBs at more than double the rate of large enterprises, credential theft has surged 160%, and attackers are mimicking trusted apps like ChatGPT to sneak malware past your staff. Here are the five stories from the past week that actually matter for your business — and what to do about each one.​‌‌‌​‌‌‌‍​‌‌​​‌​‌‍​‌‌​​‌​‌‍​‌‌​‌​‌‌‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​‌‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌‌​‌​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​​‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌​‌‌​​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

1. SonicWall Report: SMBs Carry Double the Ransomware Burden

SonicWall's 2026 Cyber Protect Report found that 88% of SMB breaches involved ransomware — more than double the rate seen at large enterprises. The report reframed the problem away from exotic zero-days and onto seven preventable operational failures it calls the "Seven Deadly Sins of Cybersecurity," including weak authentication, overexposed access, and reactive security postures.

High and medium severity attacks surged 20.8% to 13.15 billion hits globally. Automated bots now generate more than 36,000 vulnerability scans per second, and stolen credentials — not zero-day exploits — remain the attacker's weapon of choice in 85% of actionable security alerts.​‌‌‌​‌‌‌‍​‌‌​​‌​‌‍​‌‌​​‌

​‌‍​‌‌​‌​‌‌‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​‌‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌‌​‌​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​​‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌​‌‌​​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

What this means for SMBs: You are not too small to target. Ransomware actors cast wide nets and SMBs with flat networks, no offline backups, and single-factor authentication are the easiest catches. The fix isn't buying more tools — it's executing the basics: MFA on every account, tested backups, and network segmentation.

2. Credential Theft Surges 160% — Your Passwords Are the Problem

Check Point reports a 160% rise in credential-theft events in 2025, and SMB telemetry from Guardz shows over 80% of breaches stem from compromised passwords or token theft. A CyberArk study found 49% of employees reuse credentials across multiple work applications, and 36% use the same password for personal and work accounts.

Microsoft's Identity Report noted that nearly half of SMBs still rely on passwords alone without multi-factor authentication, making credential stuffing and lateral movement trivial for attackers once a single password leaks.

What this means for SMBs: Password reuse is a supply chain problem — your staff's personal Netflix breach becomes your business breach. Mandate MFA on every login that touches business data, enforce unique passwords via a password manager, and monitor for credential exposure using a free service like Have I Been Pwned. Cost: near zero. Impact: massive.

3. Spoofed Apps Luring SMB Staff Into Malware Traps

Attackers are now mimicking trusted tools — ChatGPT, Microsoft Office, Google Drive — to trick users into installing malware. For smaller businesses with less rigorous software controls, the assumption that an app "looks legit" is becoming a direct entry point for info-stealers and remote access trojans.

This coincides with SonicWall data showing bad bot traffic alone now accounts for 37% of all global internet traffic, with automated scanners probing for weaknesses every second.

What this means for SMBs: Staff download what looks familiar. Lock down software installation privileges on work devices, maintain an allowlist of approved applications, and train employees to verify download sources — especially for AI tools. A five-minute team briefing on this topic could save your business.

4. Ivanti EPMM Flaws Actively Exploited in the Wild

Two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) — CVE-2025-4427 (authentication bypass) and CVE-2025-4428 (remote code execution) — are now confirmed under active exploitation. Both flaws carry critical severity ratings and affect organisations using mobile device management or remote access services.

CISA issued emergency directives for federal agencies, but the exposure extends well beyond government. Any Australian SMB using Ivanti EPMM to manage mobile devices or remote workers is potentially vulnerable right now.

What this means for SMBs: If you use Ivanti EPMM, treat this as an emergency patch — not a monthly maintenance item. If you use any mobile device management platform, confirm your vendor's patch cadence and ensure automatic updates are enabled. Attackers are scanning for these specific flaws within hours of disclosure.

5. Ransomware Variants in SMB Environments Have Nearly Doubled

Guardz reports that ransomware variants detected in SMB environments have nearly doubled year-on-year. The average ransom payment in 2024 was US$2.73 million, and 5,243 ransomware victims were posted on leak sites — up 15% from 2023. Seventy per cent of cyberattacks in 2024 led to data encryption.

For Australian SMBs, the math is stark: downtime from a cyberattack costs roughly US$53,000 per hour (VikingCloud), and 83% of small businesses are not financially prepared to recover from a breach. Only 14% of SMBs consider their cybersecurity posture highly effective.

What this means for SMBs: Ransomware is a when, not an if. Your survival depends on three things: immutable offline backups you've actually tested restoring, an incident response plan your team has rehearsed, and cyber insurance that covers ransomware specifically. If you haven't tested a backup restore in the last 90 days, you don't have a backup — you have a hope.

FAQ

Q: I'm a 10-person business. Am I really a target? A: Yes. SonicWall data confirms attackers aren't selecting targets — they're scanning everyone indiscriminately. SMBs with weaker defences are the easiest wins. 94% of SMBs experienced at least one cyberattack last year.

Q: What's the single most effective thing I can do this week? A: Enable multi-factor authentication on every account that touches business data — email, cloud storage, accounting software, admin panels. It blocks the vast majority of credential-based attacks for zero cost.

Q: Is cyber insurance worth it for a small business? A: Increasingly yes, but read the policy carefully. Many policies now require evidence of MFA, patching, and backups to pay out. ESET research shows SMBs are increasingly using insurance as a security layer, but only 9% of small businesses currently hold a policy.

Q: How do I know if my business has been breached already? A: The average breach takes 204 days to identify (IBM). Signs include unusual login locations, slow network performance, unexpected software installations, and locked or renamed files. If you're unsure, a professional assessment is the fastest way to find out.

Conclusion

The threat landscape for Australian SMBs isn't getting more sophisticated — it's getting more relentless. The five stories this week all point to the same pattern: attackers exploit basic gaps in fundamentals, not exotic vulnerabilities. MFA, patching, backup testing, and staff training are not optional extras. They are the difference between a bad Monday and a closed business.

Take one action today: Enable MFA on your email and cloud accounts. It takes five minutes and blocks the majority of attacks.

Visit consult.lil.business for a free cybersecurity assessment tailored to Australian small businesses.

References

  1. SonicWall 2026 Cyber Protect Report — Seven Deadly Sins of Cybersecurity
  2. Check Point — Credential Theft Surges 160% in 2025
  3. IBM Cost of a Data Breach 2025 Report
  4. CISA Emergency Directive — Ivanti EPMM Active Exploitation (CVE-2025-4427, CVE-2025-4428)
  5. Guardz SMB Threat Telemetry — Ransomware Variants Double

TL;DR

  • Cyberattacks cost businesses over €200 billion every year — that's like losing a whole country's worth of money
  • More than half of businesses think AI won't change anything — but bad guys are already using AI to trick people
  • Your business needs a security plan, not just security software
  • New rules called NIS2 mean business owners are personally responsible for security

What Is This Report About?

Imagine someone broke into your store and stole everything. Now imagine that happening to thousands of businesses, every single day. That's what cyberattacks do.

A new report from Schwarz Digits (a big German tech company) found that cyberattacks now cause 70% of all money problems for businesses [1]. In Germany alone, that's over €200 billion every year — more than many countries make in a year.

This isn't just about big companies. Small businesses get hit too. And when they do, it can shut them down for weeks. They lose customers. They lose money. Sometimes they never reopen.

The Big Mistake Everyone's Making

Here's the scary part: more than half of businesses think AI (artificial intelligence) won't change anything for security [1].

They're wrong.

Think of AI like this: imagine a burglar who could break into 1,000 houses at the same time, instead of just one. That's what AI lets bad guys do in computers.

They use AI to:

  • Write fake emails that look exactly like real ones from your bank or boss
  • Create computer programs that break into systems automatically
  • Figure out your passwords by trying thousands of combinations per second

These aren't genius hackers. They're regular people using AI tools to do things that used to take experts years to learn.

The Good News: AI Protects You Too

The same AI that bad guys use? You can use it to protect yourself.

Think of it like hiring a security guard who never sleeps, can watch 1,000 security cameras at once, and notices when something looks weird — like someone trying a door at 3am.

AI security tools can:

  • Watch your business computers 24/7 for suspicious activity
  • Spot fake emails that look real
  • Lock down your systems automatically if something bad happens
  • Back up your files so you can't lose them

The question isn't whether AI will change security. It already has. The question is: will you use AI to protect yourself before bad guys use it against you?

Related: AI Attacks Now Steal Your Data in 72 Minutes

Why Small Businesses Are in Danger

You might think: "I'm too small to be a target."

Here's why that's wrong:

1. You have old computers and systems Big companies update their security all the time. Small businesses often use old software because it works and they don't want to change. But old software has holes — like leaving your back door unlocked because "it's always been unlocked."

2. You don't have a computer security expert Big companies have teams of people whose whole job is security. Small businesses might have one IT person who's also fixing printers and setting up WiFi. They're too busy to think about security plans.

3. Your employees use tools you don't know about This is called "shadow IT." Someone signs up for a free cloud storage service to share files. Another person downloads a free app for their phone. Nobody told the IT person. Nobody checked if it's safe. Now bad guys have a way in that nobody's watching.

What Is NIS2? (And Why You Should Care)

There's a new law in Europe called NIS2. It stands for "Network and Information Systems."

Here's what it means for you:

Business owners are personally responsible.

Not the IT person. Not the tech company you hired. You. The business owner.

If your business gets hacked and you didn't follow the rules, you can be fined. A lot. And in some cases, you can be personally sued.

The good news: NIS2 isn't as scary as it sounds. It's basically asking you to:

  • Have a security plan (like having a fire safety plan)
  • Know what important data you have and where it is
  • Have backups in case something goes wrong
  • Check your security regularly
  • Make sure your vendors and suppliers are secure too

Think of it like health inspections for restaurants. Annoying? Sometimes. Necessary? Absolutely.

What You Can Do Right Now

You don't need to spend millions. You don't need to be a computer genius. Here's how to start:

1. Make a list of what matters most What data would destroy your business if you lost it? Customer information? Financial records? Product designs? Write it down. That's your "protect at all costs" list.

2. Back it up If you have backups, hackers can't hold your data hostage. Use the 3-2-1 rule: 3 copies, 2 different types of storage (like a hard drive AND the cloud), 1 copy offsite.

3. Use strong passwords (and a password manager) Every account needs a unique password. Use a password manager so you don't have to remember them all. Turn on two-factor authentication (where it sends a code to your phone) everywhere you can.

4. Train your people Your employees are your first line of defense. Teach them to spot fake emails. Tell them to ask if something seems weird. Make it OK to say "I think this might be a scam."

5. Get help if you need it If you don't have a security expert, hire one. Even for a few hours to review your setup and make a plan. It's cheaper than recovering from a hack.

The Most Important Thing

Security isn't a product you buy. It's a habit you build.

Lock your doors. Back up your files. Think before you click. Teach your people to do the same.

Do these things consistently, and you'll be ahead of most businesses — including big ones with huge security budgets.

Need help building a security plan that fits your business and budget? Book a free consultation. We make security simple. → consult.lil.business

FAQ

Yes. Hackers use automated tools to attack thousands of small businesses at once. They're not targeting you specifically — they're casting a wide net. Small businesses are actually easier targets because they often have weaker security.

Backups. If you have good backups, ransomware can't hurt you. Use the 3-2-1 rule: 3 copies, 2 types of storage, 1 offsite. Test your backups regularly to make sure they actually work.

It depends on your size and industry, but basic security (passwords, backups, training, antivirus) costs very little. The report shows that cyberattacks cost €200 billion annually — spending a few hundred dollars on security is like buying insurance for your house [1].

It happens. That's why you need: (1) backups so you can recover, (2) antivirus to catch threats, and (3) incident response so you know what to do. Training reduces clicks, but nobody's perfect.

No. AI is a tool, not a replacement. Think of it like a power drill — it makes the work faster, but you still need someone to use it. AI handles the boring stuff so human experts can focus on the important decisions.

References

[1] Schwarz Digits, "The Cyber Security Report 2026 — A rude awakening for SMEs," Schwarz Digits, 2026. [Online]. Available: https://xpert.digital/en/cyber-security-report

[2] National Cyber Security Centre (NCSC), "Small Business Guide," UK Government, 2025.

[3] CISA, "Cybersecurity for Small Business," Cybersecurity & Infrastructure Security Agency, 2025.

[4] IBM Security, "Cost of a Data Breach Report 2025," IBM, 2025.

[5] Australian Cyber Security Centre, "Essential Eight Maturity Model," ACSC, 2025.

[6] Google, "Working Securely," Google Workspace, 2025.

[7] Microsoft, "Security Baseline," Microsoft Learn, 2025.

[8] Small Business Administration (SBA), "Cybersecurity Resources," SBA, 2025.

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation