Cybercrime is hunting small SA businesses — what it costs, and how to cover it

There's a dangerous myth among small business owners: 'we're too small to be a target'. The numbers say the opposite. Cyberattacks are estimated to have cost South Africa around R2.2 billion in 2025, landing at roughly 577 attacks every hour. More than 70% of SMEs report at least one attempted attack, and 80% of South African businesses said they'd been hit during 2024. You're not too small — you're the path of least resistance.

Why criminals love small businesses

Most attacks aren't a hacker hand-picking you; they're automated and indiscriminate, hunting for weak passwords, unpatched software and someone who'll click a convincing email. Small businesses tend to have thinner defences and less training, which makes them easier targets. There's a nastier twist too: under POPIA, big companies are held responsible when a supplier is breached. That makes small suppliers a favourite way into a bigger target — and 17% of 2025's breaches came through exactly this third-party route, at an average cost of nearly R30 million.

What an attack actually costs

Forget the Hollywood version. The real bill is the recovery: forensic investigators, lawyers, IT to rebuild your systems, lost income while you're down, POPIA breach notifications, and the customers you lose afterwards. The average data breach in South Africa is estimated near R44 to R50 million, and the average ransomware incident around R19 million — figures that would end most small businesses overnight.

Where cyber insurance comes in

This is the gap standard business cover doesn't fill. Cyber insurance does two things: it brings in expert incident response the moment something goes wrong — forensics, legal, PR, system restoration — and it covers the liability, the claims, the regulatory costs and the lost income. For most SMEs the response is the most valuable part: you get specialists on the problem immediately, instead of panicking and Googling at 2am. (Here's how cyber risk cover works.)

What you can do today

• Turn on multi-factor authentication everywhere — it blocks the majority of automated attacks.
• Back up your data offline, and actually test that you can restore it.
• Train your team to spot phishing — most breaches start with a single click.
• Get cyber cover in place before you need it, not after.

Cybercrime is now just part of doing business in South Africa. The businesses that survive an attack aren't the ones that were never targeted — they're the ones that were ready.