ACTIVE Habits for Small Businesses; Prevent Cyber attacks Together
You are logging into your work computer, or any computer for that matter. What thought could you be thinking that will help prevent months or years of headaches? Forming an ACTIVE habit. The Verge.com and TechCrunch.com published several articles in 2024 and 2025, unveiling that small and large businesses alike are critically threatened by cyberattacks.
Unfortunately, people like this exist to intentionally harm others. Truly heartbreaking and unforgivable. How can we form a cyber neighborhood watch? How can we help each other from these attacks?
As a small business that has invested in cybersecurity measures, first, we suggest creating a mantra for you and your staff. Before logging into your computer, think ACTIVE. “I’ll have an ACTIVE day.”
Authenticate Carefully. Confirm you’re on the correct website before entering credentials and use multi-factor authenticators (MFA).
Check for suspicious Emails that feel “off”, be aware of unexpected pop‑ups. If something feels wrong, stop and report it.
Think Before You Click. Hover over links, verify attachments, slow down on “urgent” messages, confirm requests for money, passwords, or account changes.
Identify Sensitive Data. Know what information is confidential, avoid storing data in personal drives or AI tools, and lock screens when stepping away.
Verify Requests and Identities. Call the sender using a known number and confirm vendor or payroll changes. Validate unusual instructions from “executives”. This step alone prevents most small‑business cyber losses.
Exit Securely. Log out of systems, close browsers, disconnect from VPN when done, and shut down devices during long breaks.
Secondly, small businesses are forming cooperatives.
Through a local business alliance or industry association, small businesses can share threat alerts. Pool resources for training. Negotiate group discounts on cybersecurity tools and create shared incident‑response playbooks. Where can your co-op start?
We were interested in the breakdown of the type of attacks most used against small businesses, and this is what we found: Source
What are the most common cyberattacks against small businesses?
<Attack Type, % of SMB Attacks, Description, Internal or External?>
Phishing & Social Engineering, 38% Email scams, fake invoices, credential theft, MFA fatigue, External (human error exploited).
Ransomware, 27%, Data encryption and extortion; often via phishing or unpatched systems, External.
Business Email Compromise (BEC), 15%, Impersonation of executives/vendors to divert payments, External.
Supply‑Chain / Third‑Party Breaches, 12%, Vendor software vulnerabilities (e.g., MOVEit), External.
Insider Threats (malicious or accidental), 8%, Employee misuse, misconfigurations, and stolen credentials, Internal.
This gives us an idea of some of the prevalent threats, now, but here are four examples that demonstrate the impact of these types of attacks on organizations, their stakeholders, and staff, small, medium, or large businesses.
Colorado Department of Higher Education (CDHE) - Small Education Providers (2024). The breach directly affected hundreds of small education programs, training providers, and scholarship-granting nonprofits that relied on its systems.
Attack Type: Ransomware (external)
Vector: Unauthorized access to servers storing decades of student and small‑program data.
Impact: Small education businesses lost access to records, financial aid data, and verification systems.
MOVEit Supply‑Chain Breach, a file‑transfer on Mov-It had a vulnerability breach that affected thousands of organizations, including small retailers, logistics shops, and local service providers whose data was stored by larger vendors.
Attack Type: Supply‑chain data breach (external)
Vector: Zero‑day vulnerability exploited in MOVEit Transfer software
Impact: Customer PII exposure, vendor‑system downtime, and insurance claims
Small Healthcare Clinics were affected by a ransomware attack. Many small clinics, dental offices, and specialty practices were compromised.
Attack Type: Ransomware & data theft (external)
Vector: Phishing, credential theft, and unpatched systems
Impact: Patient data exposure, appointment shutdowns, and HIPAA‑related liability
Social Engineering & Credential Theft Attacks (2024–2025), 40–72% of small businesses experienced breaches, most caused by human-factor failures.
Attack Type: Phishing, business‑email compromise (external)
Vector: Social engineering, fake invoices, MFA fatigue attacks
Impact: Payroll diversion, vendor‑payment fraud, internal account takeover.
Cyber safety is a daily habit.
Every time you and your team sign on or off your computers, pause and stay A.C.T.I.V.E. Authenticate carefully. Check for anything unusual. Think before you click. Identify sensitive data. Verify every request. Exit securely. Join us in 2026 by staying vigilant online. Taking these extra A.C.T.I.V.E. steps will spare your company from potential threats that will save your company and staff.