Small business cyber attack statistics 2026: the numbers behind the problem

Why small business cyber attack statistics matter in Minnesota

Picture a 60 person distributor in Bloomington, a 120 person engineering firm in the North Loop and a 40 person clinic in St. Paul. None of them think of themselves as a target. All of them run Microsoft 365, pay invoices by email and have a server nobody has patched since spring. To an attacker running automated scans, they look like the national brands down the road, with fewer people watching.

That is the real cybersecurity risk for Minnesota small businesses. Nobody is hunting you. Nobody has to. The 2026 reports from the FBI, IBM and Verizon describe a volume business, and volume businesses go after whoever is easiest. Four numbers belong in your next leadership meeting.

This article covers each number and what it means for a company with 25 to 500 employees. Part 2 covers the five ways companies respond and Part 3 covers what works, the layers our cybersecurity team in Bloomington runs for clients across the Twin Cities every day.

Cybercrime losses have grown five times over in five years

Every year the FBI's Internet Crime Complaint Center adds up what Americans report losing to internet crime. The line only goes one direction. In 2020 the total was $4.2 billion. In 2025 it was $20.9 billion, from more than one million complaints, almost 3,000 every day. And those are only the losses people reported.

Two line items matter most. Business email compromise, the scam where a convincing email talks someone in accounts payable into changing a vendor's bank details, cost $3.05 billion on its own. And for the first time the FBI tracked losses tied to AI enabled scams: $893 million, in year one of counting.

It is the one we see most in the Twin Cities because it needs no malware. A supplier's mailbox gets phished, a real invoice thread gets hijacked, and the "updated remittance details" arrive from an address your bookkeeper has trusted for years.

The average cost of a data breach hit a record $4.99 million

IBM's Cost of a Data Breach Report 2026 put the global average at $4.99 million, the highest in the report's history and up 12% in a single year. In the United States the average was $11.5 million, more than double the global number.

The clock should worry you more. The average breach took 247 days to identify and contain, up from 241 the year before, the first time in five editions that detection got slower. Eight months is a long time for a stranger to read your email before making a move.

Most of those 247 days is the attacker going unnoticed. The rest is recovery. Both are controllable. Monitoring cuts the first from months to minutes. A tested, immutable backup cuts the second from weeks to hours, which is why backup and disaster recovery in Minnesota belongs in the security conversation, not a separate budget line.

How attackers get in: ransomware, people and unpatched software

The Verizon 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches, and the patterns are stubborn. Attackers rarely need a clever exploit. They need one person, one password or one server nobody updated.

• The human element, 62%. A phished login, a reused password, a mistaken click. Most breaches start with a person, so most defenses have to include people.
• Ransomware, 48%. Up from 32% in the 2024 report and 44% in 2025. Among victims who paid, the median ransom was $139,875, usually the smallest part of the bill.
• A third party or vendor, 48%. Your accountant, your software provider, the contractor with VPN access. Their weak spot becomes yours.
• An unpatched vulnerability, 31%. Known flaws with published fixes. The median time to fully patch a critical flaw stretched to 43 days, up from 32.
• Phishing as the first step, 16%. Still the most common opening move, and the one AI made harder to spot.

Notice what is not on that list: a brilliant hacker beating a well run defense. Breaches in the Twin Cities are mostly made of ordinary gaps. Uncomfortable, because the exposure is yours to close. Encouraging, because closing it takes attention, not a Fortune 500 budget.

Most attacks do not break in. They log in.Solution Builders security operations center

AI powered phishing changed the rules for spotting a scam

For twenty years the advice was the same: look for the typos, the odd greeting, the link that does not match. It is out of date. According to IBM's 2026 report, more than one in four organizations hit by a malicious attack say AI was part of it, up 56% in a year, and 45% of those AI powered attacks used deepfake impersonation, a voice or face you trust, faked. An AI driven attack adds about $1 million to the cost of a breach.

In practice, a controller at a manufacturer off I-494 gets a call that sounds exactly like the owner, asking to push a wire before a flight. The report also found a quieter problem inside: companies with a shadow AI incident, where someone pasted sensitive data into an unapproved AI tool, jumped from 20% to 43% in a year.

Most of the right column lives in tools you already pay for. Microsoft 365 configured properly covers multifactor authentication, conditional access and the report button. The rest is a policy and a habit.

What to do with these numbers this week

Numbers are only useful if they change a decision. Three moves, no purchase required.

1. Put the four numbers on the leadership agenda$20.9 billion, $4.99 million, 48% and 247 days. Then ask: if an attacker had been inside our network since February, would we know?
2. Check your own clockAsk your IT lead or provider when the last full restore test was, how long critical patches take, and which accounts still lack multifactor authentication. Vague answers are answers.
3. Read the next two partsPart 2 holds the five common responses up against this data. Part 3 lays out the six layers that work. Or book a free discovery session with a Solution Builders security architect now. No pressure, just a plan.

Solution Builders has watched these numbers from Bloomington since 1995. The companies that get hurt are rarely the smallest or least careful. They are the ones where nobody was watching. Secure, the S in our RISE framework, exists so that somebody is.