Key Findings from the 2023 Business Impact Report
The Identity Theft Resource Center (ITRC) recently released its 2023 Business Impact Report, which highlighted a concerning trend among small business owners: Cyberattacks are on the rise. The ITRC conducted a survey online to understand the impacts cyberattacks are having on small businesses, as the Small Business Administration defines them. This survey was done in September 2023, and its questions were aimed at covering the respondents’ prior 12 months of business. A total of 551 small business owners, leaders, and employees completed the survey, which focused on companies with 500 or fewer employees. Let’s walk through some of the key findings of this study.
Cyberattacks are Up—Way Up
The Business Impact Report has been conducted for the last 3 years, but 2023 was the year with the highest amount of small businesses reporting cyberattacks during the year: An overwhelming 73 percent said they were victims of a breach of some sort. Historically, cyber criminals would go after larger corporations that housed loads of customer data. What the Business Impact Report reveals is that the cyberattack trend is shifting away from these traditionally targeted businesses in favor of small businesses—which might be more appealing to criminals because they lack sophisticated security measures.
According to the report, the top types of cyberattacks experienced were:
- Security Breach (29 percent)
- Data Breach (20 percent)
- Security and Data Breaches (24 percent)
The top root causes of these attacks were External Attackers (30 percent); Malicious Insiders (30 percent); 3rd-party Vendors (24 percent); and Remote Workers (21 percent). These numbers have decreased fairly significantly over last year’s findings, whereas attacks at the hands of phishing and scam/fraud have increased.
The Financial Impacts are Down
As compared to 2022, the Report saw a 4 percent increase in financial impacts of $250,000 or less, but fewer companies are reporting higher losses. Recovery funds for these breaches primarily come from cyber insurance (33 percent) and cash reserves. Some companies (13 percent) reported they reduced headcount to address the costs of security breaches. Less organizations reported revenue losses as a result of cyberattacks than in 2022. But there were different impacts that companies had to swallow, including loss of consumer trust (32 percent), employee turnover (32 percent), and difficulty understanding how and why the attacks actually happened.
Customer Impacts
A majority (83 percent) of companies that fell victim to an attack sent a notice to their impacted customers The vast majority of organizations that experienced a data; 17 percent did not. While that might seem shocking, there are reasons companies don’t necessarily let their customers know of a cyberattack—and those could be law enforcement requests (50 percent of respondents); the conclusion that no personal information was compromised (38 percent); or the conclusion that the data exposed would not pose a risk of harm to customers (21 percent). In order to help customers impacted by a breach, organizations are offering a range of recovery services—things like credit monitoring, identity recovery services, and services from non-profits.
Business Owner Confidence is Up
While cyber threats might be on the rise, the 2023 Business Impact Report found that small business owners are feeling tremendous confidence that they’re prepared to defend themselves against bad actors. In 2022, 70 percent of those surveyed felt able to defend and recover from a data breach; in 2023, that number hit 83 percent. Threats might be up, but so is the defense.
It’s critical to take preventative steps in securing your small business from cyberattacks. Check out our article, Protecting Your Small Business from Cyberattacks, for tips on how to do just that. And stick with the pros at ARF Financial and the Financial Pantry for the latest news in small business security breaches—because the more you know, the better prepared you can be.