Verizon’s 2025 Data Breach Investigations Report (DBIR) has revealed a disturbing trend: small and medium-sized businesses (SMBs) have become disproportionately targeted by ransomware attacks.

The comprehensive report, analyzing over 22,000 security incidents including 12,195 confirmed data breaches, found ransomware present in a staggering 88% of breaches affecting smaller organizations.

This marks a significant shift in attack patterns as cybercriminals increasingly focus on targets with typically less robust security infrastructure.

The financial implications for small businesses are particularly concerning, with the median ransom payment reaching US$115,000 in the past year – a sum that represents an existential threat to many SMBs operating on tight margins.

Despite this pressure, the report indicates a positive trend with 64% of victim organizations now refusing to pay ransoms, up from 50% two years ago, suggesting improving resilience and backup strategies among some businesses.

Verizon analysts identified a troubling connection between third-party vulnerabilities and ransomware attacks targeting small businesses.

According to the report, third-party involvement in breaches has doubled to 30%, creating an expanded attack surface that smaller organizations often struggle to monitor effectively.

This represents a significant shift in how threat actors gain initial access to SMB environments.

Credential theft remains the primary entry vector for these attacks, accounting for 22% of breaches, closely followed by vulnerability exploitation at 20% – which saw a concerning 34% increase over the previous year.

Small businesses, often operating with limited IT resources and outdated systems, present attractive targets for attackers employing these methods.

Attack Chain Analysis: The SMB Vulnerability Gap

The typical ransomware attack chain targeting small businesses begins with initial access through compromised credentials or unpatched vulnerabilities.

Once inside the network, attackers employ lateral movement techniques to identify and access critical systems before deploying encryption payloads.

A sample of observed PowerShell commands from recent attacks shows how attackers disable security features:-

Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableBehaviorMonitoring $true
Stop-Service WinDefend -Force

The attack methodology reveals a sophisticated understanding of small business environments, where detection gaps and limited security monitoring create perfect conditions for ransomware deployment.

The report notes that many SMBs lack proper segmentation between critical systems, allowing rapid encryption of both operational systems and backups.

Chris Novak, Vice President of Global Cybersecurity Solutions at Verizon Business, emphasized the need for “robust security measures, including strong password policies, timely patching of vulnerabilities, and comprehensive security awareness training for employees”.

For small businesses with limited resources, focusing on these fundamental security controls represents the most effective defense against the rising tide of ransomware attacks.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post Verizon DBIR Report – Small Businesses Emerges as Prime Targets for Ransomware Attacks appeared first on Cyber Security News.