Published statistics put small businesses as the target of approximately 43% of cyberattacks in 2025.
The Corpus Cannot Check This And Cannot Ignore It
This database records incidents at Jaguar Land Rover, Google, Aflac, a state government and three Ivy League universities. It has almost nothing on organisations with ten employees.
That is not because small businesses are not attacked. It is because they pass none of the five filters this desk set out at 25-0502 and extended at 25-0924b: no securities filing, frequently below notification thresholds, no class action worth bringing, no research vendor writing them up, and nobody reporting it.
The Figure Itself Deserves The Usual Scepticism
"43% of attacks" requires a denominator — all attacks, counted by whom, against a population defined how. Small business is also the largest category of business by count almost everywhere, so a share below their share of the business population would be the more surprising result.
The corpus applied the same objection to regional shares at 25-1206 and to sector shares at 25-1211b. Absolute counts describe where the most organisations are.
What Is Not In Dispute
That small organisations hold the same categories of data as large ones — identity records, payment details, employee files, customer histories — with a fraction of the capability.
The corpus recorded the small end where it happened to become visible: a nursery group at 25-0926, forty-partner law firms at 25-0910, a research association at 25-0408. Each entered the record by accident rather than through any regime designed to surface it.
Graded medium. The share figure is not usable. The coverage gap it points at is real and this database is an example of it.
Built on published small-business security statistics, listed below, read against the composition of this database. Corrections: corrections@forensicpost.com.