Almost never by someone breaking through your defences. Nearly always by someone signing in, or doing something reasonable at the wrong moment.
Short answer: Not by cracking anything. The ordinary path is that an attacker collects small pieces of true information about your business, uses them to make a message or a login look legitimate, and then signs in as somebody who already has access. Most of what people picture as hacking is really research followed by impersonation.
Key takeaways
Almost every incident that reaches a small business follows the same four steps. Understanding the order is what lets you interrupt it, because the later you notice, the more it costs.
One: collection. The attacker gathers true details. Who works there, who approves payments, which accountant you use, which software you run, what your invoices look like, when the director is travelling. None of this is secret. It comes from your website, LinkedIn, an out of office reply, a job advertisement naming your systems, a conference programme, or a previous breach at some unrelated company where a staff member reused a password.
Two: the approach. Those details are assembled into something that looks routine. An email from a supplier whose name you recognise, about an invoice you are actually expecting. A message from your own domain style. A call from someone who knows your bookkeeper's first name and the name of your practice management system.
Three: access. Someone enters a password into a page that looks right, or approves a multi-factor prompt they did not initiate, or pays an invoice with altered bank details. From the system's point of view nothing unusual happened. A valid user signed in from a browser.
Four: use. Mailbox rules are created to hide replies. Invoices are watched and edited. Data is copied. In ransomware cases, files are encrypted only after the attacker has looked around for a while.
Notice that no step involves defeating encryption or exploiting a zero day. The most common tools are patience and a plausible sentence.
This is the part most security advice skips, and it is the reason a "harmless" disclosure matters.
Every item in step one lowers the cost of step two. A generic phishing email works on a small fraction of recipients. An email that names your actual client, references your actual matter number and arrives on the day you were expecting it works on a much larger fraction, including on careful people. The difference between the two is not the attacker's skill. It is how much true detail they hold.
That is why a bookkeeper pasting a client statement into a chat tool, or an engineer uploading a tender document, is not only a privacy question. It is a supply question. Information that leaves your control can end up as material for a message that arrives back at you looking exactly right.
And credentials sit at the top of that pile. A password or an API key is not a clue that helps an impersonation. It is the thing itself.
The Australian Signals Directorate's Annual Cyber Threat Report for 2024 to 2025 recorded more than 84,700 cybercrime reports, an average of one every six minutes. The average self-reported cost per report for a small business was $56,571, an increase of 14 per cent; for a medium business $97,166; for a large business $202,691.
Two things stand out for a firm of three to twenty five people. The first is that the small business figure is not small. It is roughly the cost of an employee for a year, arriving unplanned. The second is the share of incidents starting with email, at one in three, which tells you where to spend the first hour of effort.
Business email compromise. Someone gets into a mailbox, watches, then intervenes in a real payment conversation with altered bank details. Explained separately in its own post.
Credential reuse. A password from a breach elsewhere is tried against your accounts. Automated, cheap, and effective precisely because reuse is universal.
Invoice fraud. No intrusion at all. A convincing email asks you to update a supplier's bank account.
Ransomware. Usually arriving through one of the above rather than through a dramatic exploit.
Accidental disclosure. Nobody attacked you. A file went to the wrong recipient, or a client's details were pasted into a tool that keeps them.
The last one is the one small businesses under-count, because it does not feel like an attack and produces no alert.
In rough order of value for a business with no IT function.
Multi-factor authentication on email, first. It breaks step three for the most common entry point. Enable it before anything else on this list.
A payment rule that does not bend. Any change to bank details is verified by phone, on a number you already had, never a number in the email. Write it down and make it apply to the owner too, because the owner is who gets impersonated.
No password reuse. A password manager is cheaper than one incident.
Delete what you no longer need. Records you do not hold cannot be leaked or ransomed.
Control what leaves. Decide which categories must never be pasted into an AI tool: client identity documents, bank and card details, passwords and API keys.
Prinn works on that last one. It runs on each person's computer and checks a prompt before it is sent. If it finds something sensitive it shows what it found and offers three choices: redact it, stop, or send it as is. The person decides, and it never blocks anyone. Prompt content never leaves the machine, including to us. An owner sees the category, the tool, the date, the device and the choice made, without reading anyone's prompts.
It is reliable on credentials, financial details and identity numbers. Names, home addresses and dates of birth written into ordinary prose are harder, and it is still improving at those. It does not stop phishing, does not manage passwords and is not a substitute for multi-factor authentication.
Small businesses are not targeted because they are interesting. They are targeted because the same automated approach costs the attacker nothing to point at ten thousand of them, and because a firm with no IT function is unlikely to notice a mailbox rule quietly forwarding copies of everything.
The good news in that is the same fact from the other side. Because the methods are ordinary, ordinary defences work. Multi-factor authentication on email and a payment verification rule you never bend will do more than any amount of software.