Cyberattacks continue to pose a significant threat to small businesses. According to a 2025 Mastercard survey, 46% of small and medium-sized businesses have experienced a cyberattack, while Verizon's 2025 Data Breach Investigations Report found that ransomware was involved in 88% of data breaches affecting SMBs. These statistics underscore that no business is too small to become a target. Beyond the operational disruption, cyberattacks can also result in substantial financial losses, business interruption, and reputational damage.

The good news is that there are measures that can—and should—be taken to strengthen your small business's cybersecurity. The following core practices can help protect your business today.

Key actions

• Train employees on cybersecurity best practices. With direct access to your digital systems, employees need to know how to use the internet securely. Require strong passwords, encourage regular password updates, establish policies for handling customer and company data, and prohibit unauthorized software downloads. Employees should also understand the consequences of violating company cybersecurity policies.
• Keep software up to date. Ensure computers are equipped with the latest security software, web browsers, and operating systems to defend against viruses, malware, and other online threats. Configure antivirus software to run automatic scans and install security updates as soon as they become available.
• Protect devices. Store laptops and other mobile devices in secure locations when unattended. Assign each employee their own user account and limit administrative privileges to trusted IT personnel.
• Use firewalls. Enable firewall protection for your business's internet connection to make unauthorized access more difficult. If employees work remotely, confirm that their home networks are protected by firewalls as well.
• Back up critical data. Regularly back up important business information, including financial records, human resources files, customer data, and other essential documents. Automatic backups should occur at least weekly, with copies stored securely off-site or in the cloud.
• Secure your Wi-Fi network. Encrypt your wireless network, password-protect your router, and consider hiding your network's service set identifier (SSID) to make it less visible to unauthorized users.
• Enable multifactor authentication (MFA). MFA adds an extra layer of protection by requiring users to verify their identity through methods such as a fingerprint, facial recognition, a PIN, or an authentication app in addition to a password.

Cybercriminals continue to evolve their tactics, employing malware, phishing scams, ransomware, spyware, and other sophisticated methods to compromise businesses. Small business owners should regularly assess their cybersecurity risks and, when appropriate, work with qualified professionals to develop and maintain a comprehensive security strategy.

The tax implications

The financial implications don't necessarily end with recovery if your business does experience a cyberattack. Many costs associated with responding to an attack—including forensic investigations, legal and accounting fees, data recovery, cybersecurity consulting, credit monitoring services, and certain software expenses—may be deductible as ordinary business expenses. However, the tax treatment of stolen funds, insurance reimbursements, ransom payments, and technology upgrades can be more complex.

We’re here to help

If you experience a cyberattack, maintaining detailed records of all incident-related expenses and consulting with your tax advisor can help ensure you maximize available tax benefits while remaining compliant with current tax laws. If you have questions about how to navigate the tax implications of a cyberattack, please contact our Business Tax and Advisory team.

© 2026