Cyber criminals kicking struggling businesses while their down

A new report has highlighted that financially strapped businesses, lacking the resources to fund their cyber security, are falling prey to bad actors and cyber criminals.

A new report on the impact of cyber attacks on SMEs (small and medium enterprises) in NSW has revealed that more than one in five small businesses have cut spending in cyber security despite them already being the least prepared for a cyber attack.

The report also showed that 22 per cent of small businesses and 15 per cent of medium businesses plan to reduce spending on cyber security management.

According to the Australian Signals Directorate, 94,000 cyber crimes were reported in the last financial year alone, which makes the trend of downsizing one’s cyber security even more alarming.

“Businesses dealing with ballooning insurance, energy and tax bills are alarmingly being forced to make the hard decision to cut spending on cyber security – a decision they should not be forced to make,” said Business NSW chief Daniel Hunter, who launched the SME cyber security report.

“As business overheads continue to rise, there is a risk more SMEs will de-prioritise cyber security management. Yet the average small business, if targeted by cyber criminals, is losing almost $50,000 to cyber attacks – and the problem is getting worse.”

According to the report, one in three (34 per cent) small businesses and 43 per cent of medium businesses in NSW have experienced cyber attacks in the 12 months to August 2023.

These attacks, of course, have financial repercussions for the business and employees involved; however, the effect on wellbeing and mental health cannot be understated when an employee goes through a cyber crime ordeal.

“Businesses have told us about the devastating impact on staff wellbeing. One staff member of a regional NSW bookkeeping business suffered a severe mental health impact as a result. These stories are all too common,” Hunter said.

Concerningly, 41 per cent of small businesses and 15 per cent of medium businesses have taken no actions to enhance cyber security as they can’t afford it. It’s evident that during the tumultuous economic climate, deterrence of threats such as cyber crime drastically falls down the priority list of businesses that are struggling.

Hunter believes the responsibility for protecting SMEs from these threats falls on the shoulders of the government, both local and federal.

“The NSW and federal governments must rapidly incentivise SMEs to ensure they have the appropriate level of cyber protection,” Hunter said.

Dr Andrew Charlton MP, special envoy for cyber security and digital resilience, was responsible for the launch of the SME Cyber Security Management report at Business NSW’s Sydney HQ.

“I know firsthand the pressures of running a small business, especially when every dollar counts,” Charlton said.

“The good news is that there are basic steps every small business can take to significantly reduce cyber risk, often at no or minimal cost. This includes using strong, unique passwords, enabling multifactor authentication, and keeping software up to date.”

“On top of that, the government’s cyber programs and the $20.8 million Cyber Health Check offer further support to help protect your business without adding to your financial strain.”

Business NSW offered an action plan they believe the government should implement to support SMEs that are struggling to afford the appropriate cyber security resources. Business NSW is calling for:

• The federal government provide a 20 per cent deduction bonus on all cyber security-related expenditure to enable businesses to invest in cyber security.

• The NSW government to expand the Service NSW Business Bureau’s role to include guidance on cyber security for businesses.

• The federal and NSW governments to continue to review current small-business-focused cyber initiatives to understand their take-up and efficacy.

• The federal and NSW governments – together with relevant industry leaders and membership organisations – to combine to support SMEs and ensure their cyber security.