By Peter Boolkah, Award-Winning Global Business Coach and entrepreneur
A few months ago, I heard the story of a young estate agent. His father, who runs a small building firm in Hertfordshire, had just lost £60,000 to a phishing scam. All it took was one email. It looked like an invoice for materials he had ordered for a job he’d just taken on. He clicked the link and transferred the money. By the time he realised, the scammers were long gone and so was his money. His bank told him it was too late, they couldn’t help because he’d authorised the payment himself. There was no cyber insurance. No email filtering. No safety net. That £60,000 represented more than money. It meant he couldn’t help pay for his son’s wedding. It shattered his confidence. And for a business turning over about £1 million a year, it was nearly fatal.
This isn’t a one-off. It’s happening every day, and it’s getting worse. The Cyber Security Breaches Survey 2025 shows that over 43% of UK businesses and 30% of UK charities experienced a cyberattack in the past year. That’s roughly 612,000 businesses and 61,000 charities. And those are just the ones that reported it. SMEs are the real frontline of this war, not the household names like Marks and Spencer that make the headlines. We’re talking small delivery firms, estate agencies, local builders, accountants, legal advisors, and manufacturers. And the public feels the impact when they fall.
One phishing scam disrupted Speedy Deliveries Ltd. operations so badly that they couldn’t fulfil orders across the South of England. Shops didn’t get their stock. Families didn’t get parcels. The company collapsed. Another SME badly affected by cyber crime was Heritage Legal Services who were crippled by ransomware. Client data was compromised, and operations were frozen. In this situation, this meant that real people lost access to justice.
Cybercriminals are getting smarter. They’re using AI tools to craft more convincing emails. They mimic writing styles. They scrape data from social media to personalise scams. They combine phishing, ransomware, and social engineering in layered attacks that are harder to detect and devastating when they land. And SMEs are seen as easy targets, low-hanging fruit. This is because many don’t have even basic defences in place. No multi-factor authentication. No regular backups. No staff training. No insurance. At the same time, they’re more digitally dependent than ever. They use online banking, cloud storage, and digital invoicing, amongst other remote work digital tools. The fact is that every added convenience is also a new vulnerability. However, most SMEs wouldn’t last a week without access to their systems.
If you own or run an SME, you cannot afford to ignore cybercrime. A serious cyberattack can destroy your business. Research shows 60-70% of SMEs shut down within two years of a major breach. The financial damage is just the start; there’s also reputational harm, lost clients, legal trouble, and emotional toll. It doesn’t even have to be your own systems that are hit. You could go down because a supplier gets compromised. You might rely on software that gets breached. Your data could be leaked by a third-party vendor. This is a chain, and you’re only as strong as your weakest link.
I get asked by clients what they as SME’s can do, and it’s simple. You don’t need a million-pound IT department, but you do need a plan and to start with the basics. Invest in email safety and filtering tools that can block known phishing attempts before they ever reach your inbox. Educate your team. Many attacks succeed simply because someone clicked a dodgy link or used a weak password. Make sure that you back up your files regularly and store them securely off-site. If ransomware hits, you’ll need a clean version of your systems to restore from. Cyber insurance is not just for big corporations. It can be a lifeline if you suffer an attack. One of the easiest and most effective ways to protect your accounts is with two-factor authentication. Finally, know who to call and what steps to take if the worst happens.
Cybersecurity is now as essential as locking the front door of your premises. It’s a matter of survival. Remember that protecting your business is protecting your people, your team, your clients and your suppliers. Don’t let your business be the next target for cybercriminals.
