Ransomware’s Going After Smaller Companies, not Just Big Banks
For years I figured ransomware gangs went after the big names — banks, hospital systems, companies you'd recognize from the news. A report that came out this past August says that's wrong. They've been going after smaller companies the whole time, and the number is bigger than I expected.
What the report actually found
Cyber-risk research firm Black Kite looked at over 13,000 ransomware incidents across North America and Europe, from January 2023 through this past June. Wherever they could pin down a victim's revenue, they sorted it into "mid-market" — $10 million to $1 billion a year in revenue — or everyone else. Mid-market came out to 73% of all the incidents they tracked. And it's not a one-year blip: 74.6% in 2023, 72.1% in 2024, 74% in 2025, 72.3% so far this year. Same story, four years running.
"Mid-market" in that report runs from $10 million to $1 billion a year in revenue, and more than half of those victims came in under $50 million — the low end of that range. These gangs have moved down-market, away from the giant names, and nothing in the data says they stop at $10 million. Manufacturing got hit hardest, at roughly a quarter of all mid-market victims, with professional and technical services and construction right behind it.
The reason these companies kept getting hit isn't exotic. Over half — 54.7% — had an unpatched piece of software accessible from the public internet. Close to a third had employee login credentials already circulating on stolen-password lists before anyone noticed. Almost half had email systems without proper DMARC protection set up — the thing that's supposed to stop someone from sending an email that looks like it came from your own company.
Why this matters
None of that requires a nation-state hacking team with a grudge. It requires attackers running a list of known software bugs against the internet and waiting to see who hasn't patched yet. "We're too small for anyone to bother with us" is a thing I used to hear a lot, and this report says that's exactly backwards. You're not too small to be worth it. You're the easier math — smaller security teams, same valuable data, same bank account to extort.
The bottom line
Do you know, right now, whether the computers and software your business exposes to the internet are up to date with all their security patches? Do you know if your email is configured correctly - and checked recently? If you don’t, get it checked this week, before a statistic like 73% has your company's name attached to it.
If you're a client of Revolution Group, patch management and email authentication are part of what we keep an eye on for you as a regular part of our relationship. Give us a call if you’d like help tightening your security – our experts would love to help you and your business be safer and more secure.
— Rick