Key figures
- The number of cyberattacks on Russian business almost doubled in a year. In the first months of 2025 alone, more than 105,000 incidents were recorded (RED Security SOC data).
- In the first quarter of 2026, the Bank of Russia reported an almost twofold rise in malware attacks on legal entities.
- Kaspersky Lab reports a rise of about 35% in attacks on SMEs.
- Total damage to business from cyberattacks runs into hundreds of billions of roubles. Solar 4RAYS and BI.ZONE estimate it at about RUB 1.5 trillion for 8 months of 2025.
- A significant share of successful attacks brings operations to a halt.
Why SMEs are an easy target
SMEs usually have weaker protection and a smaller safety margin: one ransomware attack can stop revenue for days or weeks. At the same time, many owners believe that “we are too small to be attacked”. Yet today's attacks are often mass and automated, and they do not look at company size.
Practical takeaways
- Do not try to estimate the odds of “will we be hit or not”. Assess readiness instead: what stops first and how long it takes to recover.
- Protection costs several times less than recovery, so investing in advance pays off.
- The basic minimum: isolated backups, a plan for the first hours, a trained team.
For more, see “The IT department does not protect the business” and “What to do in the first hours after a cyberattack”. You can check your own readiness with a free 5-minute assessment.
Frequently asked questions
Is it true that small businesses are attacked less often?
No. Many attacks are mass and automated, with no selection by size. SMEs also have weaker protection and a smaller safety margin, so the consequences are often more severe.
Where do the cyberattack figures come from?
From reports by specialist companies and the regulator: RED Security SOC, Solar 4RAYS, BI.ZONE, Positive Technologies, Kaspersky Lab and the Bank of Russia. The exact values vary from report to report, but the trend is steadily upward.
Is your team ready for the first hour of a crisis?
You test a plan by running a scenario. Reading it is not enough. The assessment shows the gaps, and the corporate format works through them with your team on your own processes.
