Who attacks SMEs, and why?

SMEs are mainly targeted by criminal groups who want money: either by locking or stealing their data to sell it back, or by tricking them into making a bank transfer. It is almost never personal: the attacker is looking for an open door, not for your business in particular.

What has changed since 2025

Ransomware has become a service: one group develops the tool and the infrastructure, then rents them out to “affiliates” who carry out the attacks and share the ransom. Others resell access that has already been stolen (email credentials, VPN access) to anyone willing to buy it. So the attacker no longer needs to be skilled: paying is enough.

In its threat overview published on 11 March 2026, ANSSI notes that data encryption is declining in favour of data theft alone, followed by blackmail threatening publication, and that internet-facing equipment (firewalls, VPNs) is exploited very quickly after a vulnerability is published.

Alongside this, bank transfer fraud requires no technical skill at all: a fake supplier sends new bank details, or a fake executive demands an urgent payment.

State-sponsored attacks do exist, but they mainly target public bodies and large corporations: they are not an SME’s main risk.

To check this week

Questions about your situation? Describe my needs

Sources consulted on 19 October 2026: ANSSI – Panorama de la cybermenace 2025, published on 11 March 2026; Cybermalveillance.gouv.fr – Fraude au faux ordre de virement (FOVI).
Article written by IT CyberWall.

Backup and restoration are operated by WeDoBack.