Central Insurance Blog

When you picture a cyber attack, you might imagine a major corporation making headlines after a high-profile data breach. However, the reality of cyber attacks is much quieter and much closer to home.

Small businesses are increasingly becoming cybercriminals’ preferred targets because they see them as easier marks. With fewer resources, limited IT support, and less formal cybersecurity training, small companies often lack the defenses hackers hope to bypass.

“Small businesses tend to think cyber criminals won’t come after them,” says Cory Eickholt, director of loss control at Central Insurance. “That mindset is exactly what makes them extra vulnerable. Attackers know there’s often less oversight, less training, and fewer controls to protect their assets. It’s not about the size of the business, it’s about the ease of entry.”

In this article, Eickholt and Jeff Lieberman, director of special investigations at Central, share insights on the real threats facing small businesses today and steps business owners can take to protect themselves, their employees, and their customers better. 

---

Jump Ahead:

• Why Small Businesses Are a Prime Target for Cyber Attacks
• The Top 5 Most Common Cyber Attacks on Small Businesses
• How to Prevent a Cyberattack on Your Small Business
• How to Create a Cyberattack Incident Response Plan
• What Cyber Insurance Covers & Why You Need It

---

Why Small Businesses Are a Prime Target

The rise of remote work, cloud-based tools, and online payments makes doing business easier, but this digital evolution also opens the door to increased cyber risks.

“We’ve seen a steady increase in claims involving ransomware, phishing, and social engineering,” Eickholt says. “It’s not just the big guys. Everyone can be exposed now.”

Lieberman has spent years investigating fraud cases at Central and says social engineering—a practice where attackers manipulate people into handing over sensitive info or money—is one of the most common methods they encounter.

“These criminals are patient and smart,” Lieberman says. “They build trust with employees, pose as vendors or executives, and create believable scenarios that trick people into making wire transfers or sharing credentials. They’re not necessarily breaking into your system; they’re walking through the proverbial front door because someone held it open for them.”

Lieberman points to a rise in fake LinkedIn profiles as an example of a growing threat. 

“We’ve seen a surge in fraudulent accounts posing as industry professionals to build false credibility. It’s part of a broader strategy to embed themselves into networks and exploit that trust,” he says.

The Top 5 Types of Cyber Attacks

Throughout their combined years of experience, Eickholt and Lieberman have seen cyber risks of all kinds. Below, we explore common cyber attacks and offer advice on preventing them. 

Phishing

When a cyberattacker uses a “phishing” approach, they send fraudulent emails designed to mimic trusted sources to trick users into revealing sensitive information or downloading malware.

Real-World Example: A Connecticut vintage furniture shop had over 200 fake PayPal invoices sent to its customers. The scam started when attackers got access to the owner’s email password. Customers were confused, payments were delayed, and the owner had to shut down her PayPal account while cleaning up the mess.

Takeaway: Phishing isn’t just spam; it can bypass well-protected networks by targeting people’s trust. It can look legitimate and cause serious financial and reputational harm.

Reduce Your Risk: Use multi-factor authentication (MFA) on all email accounts.

Social Engineering

Social engineering schemes involve attackers impersonating real people to manipulate their targets. Cybercriminals present themselves as trusted people—like vendors, colleagues, or company leader—to manipulate employees into taking harmful actions. Asks may include transferring funds, sharing login credentials, or clicking on malicious links. These schemes typically leverage urgency, authority, or fear to trick victims into complying with their ask. 

Real-World Example: Scammers convinced an employee at Scoular, a U.S. commodities firm, to wire $17 million by pretending to be the company’s CEO. The fake emails even mentioned their real accounting firm to sound more believable.

Takeaway: Attackers meticulously study their targets, sometimes spending months building trust and credibility. They don’t have to break in if they can trick someone into letting them in. 

Reduce Your Risk: Always verify money requests or payment changes by calling a known contact at a number you already have on file.

Ransomware

Hackers use ransomware to lock up your files and often demand money to unlock them. They typically request payment in cryptocurrency.

Real-World Example: KNP Logistics, a 158-year-old shipping company, shut down after a ransomware attack. Hackers gained access through a single weak password. With no backups and no way to recover, the business collapsed.

Takeaway: One weak password—and no recovery plan—can put you out of business.

Reduce Your Risk: Use a password manager to create strong passwords and back up your data regularly in a secure, offline location.

Data Breaches

Data breaches occur when sensitive information—like customer names, Social Security numbers, financial records, or login credentials—is accessed, stolen, or exposed. Data breaches can happen through targeted cyberattacks, lost or stolen devices, employee mistakes, or third-party system vulnerabilities. Not all breaches involve malicious cybercriminals; sometimes they result from something as simple as an employee emailing a file to the wrong person. Regardless of how it happens, a breach can lead to identity theft, legal liability, reputational damage, and costly remediation. 

Real-World Example: In late June 2025, a public database tied to the Gladney Center for Adoption in Texas exposed over 1.1 million records. These records included names, addresses, phone numbers, court data, medical records for children, adoptive and birth parents, and staff. 

Takeaway: You don’t need to be a big company to suffer a significant data breach, and it will cost you customer trust, legal fees, and more. 

Reduce Your Risk: Work with an IT provider to check your systems for weaknesses and fix them. Ensure sensitive info is encrypted and stored securely.

Get insights like this right in your inbox. Subscribe to the Central Blog below.

Steps to Prevent a Cyber Attack On Your Business

While cyber threats continue evolving, small business owners can take simple, practical steps to protect their business and improve resilience. Let’s explore a few actions you can take to avoid becoming a cyber attack victim. 

1. Start with Employee Training

“Training, education, and awareness are the keys to preventing cyberattacks,” Jeff says. “It doesn’t cost anything to slow down and verify an email or question a request. That awareness can stop a breach before it starts.”

In many cases, a breach starts with a simple mistake, like an employee clicking a suspicious link or trusting an email that looked just close enough to the real thing. Even the best firewalls can’t protect your business if someone unknowingly invites an attacker in. 

The Bottom Line: Employee behavior and awareness are often your first, last, and most powerful line of defense.

What you can do:

• Run phishing simulation exercises to test team awareness. Mock attacks can help you identify employees needing more training and give your team hands-on experience spotting red flags before encountering real threats.
• Set clear rules around handling payment or data requests. Establish internal protocols, like requiring secondary confirmation for wire transfers or password changes, so employees know how to respond to unusual or urgent requests.

2. Require the Use of Strong Passwords—and Regularly Update Them

“We’ve seen cases where someone had the same password for two decades,” Lieberman says. “That’s low-hanging fruit for criminals.”

Weak or reused passwords are one of the easiest ways attackers hack into otherwise protected systems. Once these cybercriminals have a working password—sometimes leaked from another breached site—they can test it across your business platforms until something clicks. Hackers often use automated tools to try thousands of passwords in seconds. If yours is something like “Welcome123” or “Company2020,” you’re at increased risk, especially if you use the same login across multiple platforms.

What you can do:

• Use a password manager to generate and store complex passwords. Password managers make it easier for employees to follow strong password practices without relying on memory or risky shortcuts like reusing the same credentials.
• Set company policies to change passwords every three to six months. Regular updates reduce the risk of long-term exposure if a password is compromised and encourage more secure behaviors across your team.
• Require unique passwords for each platform or software tool. Using the same password across systems can lead to a domino effect if one is breached. Unique passwords limit the potential impact of a successful attack.

3. Implement a Multi-Factor Authentication (MFA) Tool

Passwords can be stolen, guessed, or phished. Using MFA makes it much harder for anyone to access your systems without your device or approval. A second layer of verification, like a text message code or authentication app, can stop many attackers, even if they manage to get your password.

What you can do:

• Require MFA for email, cloud storage, payroll platforms, and other business-critical tools. MFA adds an extra layer of protection by requiring a second verification form, helping block unauthorized access.
• For better security, use an authenticator app instead of SMS when possible. Authenticator apps are less vulnerable to certain attacks, making them a smarter choice for verifying logins to sensitive systems.

4. Create An Incident Response Plan

Eickholt recommends building an incident response plan that outlines what to do in the event of an attack, including communication priorities and delegations outlining who is responsible for each step of the recovery.

“Even a simple plan is better than scrambling during a crisis,” Eickholt advises. “When something goes wrong, you want to know exactly who’s doing what, and how fast you can contain it.” 

Below, we outline what a proper incident response plan should entail.

How to Create a Cyber Attack Incident Response Plan

No system is foolproof, even with strong passwords, regular employee training, and top-tier protection. Developing an incident response plan is one of the smartest—and often most overlooked—steps to protect your business.

Incident response plans outline what your business will do in the hours and days following a cyber attack. It helps you act quickly, limit damage, and start recovering as efficiently as possible. Here’s how to build one:

1. Identify Your Response Team

Decide who will be involved in your response strategy, and what each person is responsible for. This team may include:

• Your internal IT person or outsourced provider
• A senior leader or decision-maker
• Your legal advisor
• Your insurance carrier or Cyberscout contact
• A communications lead (internal or external)

2. Outline Immediate Actions and Steps to Take

Spell out precisely what your team should do when they learn something is wrong, including:

• Disconnecting affected systems from the internet
• Preserving logs or evidence of the incident
• Reporting the issue to your cyber insurance provider
• Contacting law enforcement if criminal activity is involved

3. Define Internal and External Communication Plans

Plan what you’ll say and share if a breach occurs. Clear, honest communication helps maintain trust and shows that you take the issue seriously. Communications should include:

• Notifying your employees
• Reaching out to customers if their data is compromised
• Coordinating messaging with your legal team or PR rep

4. Document Recovery Steps

Map out how you’ll get back up and running, including:

• Restoring systems from backups
• Changing passwords or access credentials
• Verifying that vulnerabilities have been fixed
• Reopening services or platforms after testing

5. Schedule a Post-Incident Review

Reviewing what went wrong helps you refine your plan and better prepare for future threats. Once the dust settles, sit down with your team and ask:

• What worked well?
• What needs improvement?
• How can we strengthen our systems going forward?

What Cyber Insurance Covers and Why You Need It

Cyber Suite is Central’s comprehensive cyber coverage built for small to midsize businesses. It’s more than just a policy; it’s a proactive partnership that helps protect your operations, data, and reputation before, during, and after a cyber attack. If something goes wrong, this coverage offers access to experts who can guide you through the response.

Cyber Suite coverage comes into play when a hacker locks down your systems, steals sensitive information, or tricks an employee into wiring money. It can help cover the cost of restoring data, notifying customers, recovering lost income, and responding to lawsuits or regulatory investigations.

One of the most valuable benefits of Cyber Suite is our partnership with Cyberscout, a team of professionals available 24/7 to help you take fast action after a cyber attack. Cyberscout can help kickstart a post-cyber attack investigation and limit the spread. 

Industry Recommendation: Lieberman suggests that small businesses utilize DeleteMe. This privacy service scrubs personal information from public websites and data brokers,  sources that attackers often rely on to impersonate employees or vendors. “The less information cyber criminals can find about you, the harder it is for them to impersonate you,” he says. 

The Central Difference

No business is too small to be targeted by cyber criminals, but the right tools, knowledge, and coverage can help protect everything you’ve worked to build. When proactive planning isn’t enough to prevent an attack, Central’s specialized cyber coverage helps you recover with support from a team that knows exactly what to do. 

Talk to your agent to learn how Cyber Suite can provide big protection for your small business.