Cyberattacks hit 87% of APAC small businesses, Kaspersky survey finds

KUALA LUMPUR — Nearly nine in 10 small and medium-sized businesses (SMBs) across Asia-Pacific experienced at least one cyber incident over the past 12 months, with attacks resulting in stolen customer information, disrupted services and financial losses, according to a new survey by cybersecurity company Kaspersky.

The survey of IT and cybersecurity professionals found that 87% of respondents from the APAC SMB sector had experienced at least one cyber incident during the period. Software vulnerability exploits were identified as the most damaging type of attack by 10% of respondents, followed by mass malware attacks and external remote access incidents, both at 7%.

The findings highlight the growing exposure of smaller businesses to cyber threats, which can disrupt daily operations, compromise sensitive information and undermine customer confidence.

Among businesses that experienced cyber incidents, 25% identified the theft of clients' personal data as one of the most damaging consequences. Temporary disruption to customer-facing services, including websites and online stores, and the theft of employees' personal data each affected 23% of respondents.

The financial and operational consequences extended further. Some 21% of affected businesses reported financial losses, while an equal proportion experienced irrecoverable data loss. Another 13% reported irreversible damage to corporate assets.

The findings underline how a single incident can create lasting consequences for businesses with limited resources to absorb losses, restore systems or manage the reputational fallout.

Data theft drives cybercriminal activity

Kaspersky's survey suggests that cybercriminals are primarily motivated by access to valuable business and personal information.

The theft of clients' personal data was identified as a leading attacker objective by 34% of APAC respondents. This was followed by attempts to obtain sensitive internal information, including financial credentials and legal documents, at 31%, and employees' personal data at 27%.

A further 23% cited attempts to prevent employees and customers from accessing online resources, reflecting the operational disruption that can accompany cyberattacks.

The concentration on data theft presents risks beyond immediate financial damage. Stolen information can expose customers and employees to further fraud, while compromised business credentials may provide attackers with additional opportunities to infiltrate corporate systems.

IT and finance teams among prime targets

IT and IT-security departments were the most frequently targeted areas in the survey, cited by 51% and 52% of respondents respectively when identifying departments affected by their organisations' most harmful cyber incidents.

Customer service departments were next at 22%, followed by accounting and finance at 20%.

The results indicate that cyber risks are not confined to technology infrastructure. Customer-facing teams and financial functions can also become entry points for attacks or suffer direct consequences when systems are compromised.

Kaspersky Managing Director for Asia Pacific Adrian Hia said cyber threats varied across markets and attack methods, but their effects could spread throughout an organisation.

A single incident could compromise sensitive information, interrupt routine operations and weaken customer trust, he said, adding that cybersecurity required appropriate technology, security awareness and consistent cyber hygiene across business practices.

Ilya Markelov, head of Kaspersky's Unified Platform Product Line, said cyber incidents could have particularly severe consequences for smaller companies because of their resource constraints, sometimes threatening their survival.

Businesses strengthen defences

The survey found that APAC businesses were responding to incidents by strengthening security controls and improving internal capabilities.

Deploying IT security monitoring solutions, enhancing cloud security controls and tightening third-party compliance requirements were each cited by 24% of respondents as measures taken following cyber incidents.

Other actions included specialised training for IT personnel, deploying security solutions across employees' devices, revising password policies and implementing multi-factor authentication. Each measure was cited by 22% of respondents.

Kaspersky recommends that SMBs adopt cybersecurity solutions suited to their size, budgets and operating requirements, alongside stronger access controls, regular data backups and ongoing employee training.

The company also advocates requiring IT approval for new software and promptly revoking access to corporate systems and cloud services when employees leave an organisation.

The survey covered 1,800 respondents across 18 countries, including Malaysia, Indonesia, India, China, Thailand and Vietnam. The SMB segment accounted for 616 respondents in the global sample.

The findings reinforce the need for businesses to treat cybersecurity as a core operational and governance issue rather than a responsibility confined to IT departments, particularly as digital services and cloud-based systems become increasingly integral to everyday business operations.

Caption: Cyberattacks are exposing Asia-Pacific small and medium-sized businesses to customer data theft, service disruption and potentially irreversible losses, according to a Kaspersky survey. (AI-generated image, if applicable.)