Why small businesses are attractive targets for identity thieves

Identity thieves aren’t overlooking small businesses. They are going after them because the payoff can be big and the barriers are often lower. A smaller company can hold valuable data and money without having the layers of security that make a larger target harder to crack.

According to the Identity Theft Resource Center, 81% of small businesses have reported a security breach, such as a data incident, in the past year, and it’s not down to bad luck. Identity thieves are really choosing small businesses more than other kinds of targets.

Cyber Threats Small Business Owners Face

Identity thieves target these small operations because the payoff can rival that of a larger corporation, but their security tends to be thinner. While identity thieves tend to use elaborate scamming methods, they pick their target to reduce their workload. The solution, therefore, is to increase your security measures and make your company less of an attractive target.

Opportunistic criminals won’t break into a large corporate network when they can get the same payoff from a five-person accounting firm. If their aim is business identity theft and they want to acquire tax IDs or bank credentials, these are accessible through both small and large businesses. Small businesses are often those that get hit on the IT side.

What the Data About Identity Thieves Shows

Data shows how attacks are moving beyond the realm of science fiction. More than 40% of small business cyberattacks in 2025 were identified as having AI tools as a root cause. In the past, when firms were hit by cyberattacks, there would be a human operator directly in the loop, but it’s increasing the risk of being attacked by a much more autonomous AI agent acting on behalf of a human operator, and this operates more independently.

This means that criminals have vastly upgraded their operating capacity, and small businesses need to counter this in the realm of preventative security and protecting business data. Automated phishing and cloned emails can do in minutes what it used to take criminals days of manual research to achieve.

For example, if cyber criminals are going to attempt a social engineering attack, they will need to have information. Information about the target company, for example, who is the CEO, what the corporate structure is like, and how their cybersecurity works.

Weak Business Cybersecurity Is What Identity Thieves Count On

While most of us understand the clear benefits of multi-factor authentication, opting to use it in our own personal lives, multi-factor authentication adoption among small businesses is relatively low.

The ITRC’s 2025 Business Impact Report found that the number of small businesses adopting multi-factor authentication has actually declined in recent years. There are certainly identity thieves reading these statistics and planning to target small businesses.

Where Identity Theft Protection and Small Business Security Start

Small businesses are not too small to be noticed. They are small enough to be easy targets. Criminals often look for simple gaps such as weak authentication, untrained staff, or the clearly mistaken assumption that attackers will focus on larger companies.

Fixing these problems is usually far cheaper than dealing with a breach. It also makes a business less attractive to criminals looking for an easy opportunity. Identity thieves tend to follow the path of least resistance.

Interested in reading similar stories as well as information about local news and events in Baltimore? See our archives for more.