The reality of SME cyber attacks
The numbers are stark. Small businesses are targeted more frequently than enterprises — partly because they're perceived as easier targets, and partly because they hold valuable data (client financial information, legal records, personal data) without the security infrastructure to protect it.
And Microsoft 365 is frequently at the centre of these attacks. Business email compromise — where attackers take over a Microsoft 365 account and use it to intercept payments, steal data, or impersonate the business — is one of the fastest-growing forms of cybercrime targeting SMEs.
What a breach actually costs — broken down
- Emergency IT forensics and containment — identifying how the breach occurred, what was accessed, and stopping further damage. £2,000–8,000
- Business downtime — staff unable to work while systems are investigated and restored. For a 10-person business, even 2 days of downtime can cost £5,000–15,000 in lost productivity
- Emergency communications — informing affected clients, suppliers, and staff. Management time alone can represent £1,000–3,000
- Password resets, MFA re-enrolment, and account recovery across the entire organisation
- ICO notification is mandatory within 72 hours if personal data is breached. Failure to notify can result in fines. Fines for serious breaches can reach 4% of annual turnover
- Legal costs for advice on GDPR obligations, client notifications, and potential claims. Typically £2,000–10,000 for a small business
- Client notification costs — particularly significant for accountants and solicitors who hold large volumes of personal data
- Cyber insurance claim processing — if you have insurance, the claims process takes time and management resource
- Client loss — businesses in regulated sectors (accountancy, legal) can lose clients permanently after a breach. Losing even two significant clients can mean £20,000–100,000+ in lost annual revenue
- Increased cyber insurance premiums — typically 30–100% higher after a claim, for 3+ years
- Remediation investment — properly securing the environment after a breach typically costs more than it would have cost to do it correctly in the first place
- Management distraction — the time spent dealing with breach consequences takes senior management away from running the business for months
Business email compromise — the most common M365 attack
Business email compromise (BEC) is the most financially damaging form of cybercrime targeting SMEs. Here's how a typical attack unfolds:
- Account takeover. An attacker obtains an employee's Microsoft 365 credentials — usually through phishing — and signs into their account. Without MFA enforced, this is trivial.
- Silent monitoring. The attacker reads emails silently for days or weeks, learning the business's payment processes, client relationships, and communication patterns.
- Interception. When a significant payment is expected — a client paying an invoice, a property transaction, a supplier payment — the attacker intercepts the communication and substitutes their bank account details.
- Discovery. The fraud is typically discovered when the legitimate payment doesn't arrive, often weeks later. By then, the money is gone.
Average losses from business email compromise attacks on UK SMEs range from £15,000 to over £200,000. Banks rarely refund these losses in full, as the payment was authorised by the business.
The cost of prevention vs the cost of a breach
Let's put this in concrete terms for a 10-person SME:
The economics are not complicated. Proper Microsoft 365 security costs a fraction of a single breach. The question isn't whether you can afford to secure your environment — it's whether you can afford not to.
Find out how secure your Microsoft 365 is right now
Book a free Microsoft 365 Health Check. We'll assess your security configuration and tell you honestly whether you're at risk — before an attacker finds out for you.
Book Your Free Health Check →Key takeaways
- 43% of cyber attacks target small businesses — SMEs are the primary target, not an afterthought
- The average breach costs a UK SME over £15,000 in direct costs alone, far more including reputational damage
- Business email compromise is the most common and financially damaging Microsoft 365 attack
- MFA enforcement alone prevents over 99% of account takeover attacks
- All the tools needed to prevent the majority of breaches are included in Business Premium
- Years of proper managed IT costs less than a single breach
About SRX IT Solutions
Microsoft 365 security specialist based in Birmingham. We help SMEs configure and maintain proper Microsoft 365 security — so a breach doesn't happen in the first place. Learn more →