Until recently, it was believed that cybercriminals primarily targeted large businesses. More data, bigger budgets, and consequently greater potential damage. However, in recent years, small and medium-sized businesses have increasingly come under attack.
, in 2025, attacks on companies in this segment accounted for more than 70% of all cyber incidents. Digital hygiene is an essential component of corporate security. In this article, we will examine why attacks occur, what types of attacks exist today, and how businesses can protect their data.
Why Attacks Occur
Let's examine each reason separately to get a clearer picture:
Digital transformation. For businesses, it expands the so-called “attack surface.” Every new service, cloud storage, work chat messenger, or integration with external partners is a potential entry point for an attacker. The more digital tools a company uses, the more carefully it must build its security perimeter.
Availability of attack tools. the growth of the Ransomware-as-a-Service (RaaS) model. Cybercriminals offer malicious software “by subscription,” allowing even beginners to launch sophisticated attacks without deep technical knowledge. Automated vulnerability scanners operate around the clock, identifying weaknesses in configurations, outdated software, or weak passwords.
Ease of targeting SMBs. Companies without information security specialists, backup systems, or monitoring tools are more likely to become victims of ransomware attacks. When restoring data from backups is impossible and business processes are halted, the decision to pay a ransom is often made more quickly.
Use of public services for work. Telegram, WhatsApp*, Viber, and other messengers are often used not only for personal communication but also for work-related tasks without centralized control from the IT department. For example, an administrator cannot force-enable two-factor authentication on employees’ devices, revoke access for a dismissed employee, or prohibit file forwarding outside the company.
How exactly do attackers gain access to company data? Here are several common methods:
- intercepting verification codes through SIM swapping;
- sending phishing links directly through private messages;
- compromising accounts to distribute malicious documents on behalf of executives;
- spoofing employee phone numbers in messengers and email.
Corporate messengers contain valuable information: customer databases, financial reports, project documentation, and internal correspondence. If access is not properly restricted and logs are not monitored, a data breach can go unnoticed for weeks.
Let's take a closer look at the "weak points" of messengers.
What Attacks Are Common in Messengers
According to Maxim Ruban, Head of Information Security at the eXpress corporate communications platform, company employees regularly encounter several major types of cyber threats that spread through messengers and other digital communication channels.
The most common include:
- social engineering, where attackers use information from social networks and open sources to create messages that inspire trust in the victim;
- malicious attachments, such as viruses and trojans distributed through files disguised as documents, presentations, or other work materials;
- data breaches caused by weak passwords or flaws in authentication mechanisms;
- fake authorization requests asking users to confirm a login or perform another action;
- phishing campaigns and Fake Boss attacks, in which attackers impersonate trusted senders, executives, or colleagues.
“Falling into one of these traps means creating conditions for a successful attack, the consequences of which can result in serious losses for a company: lawsuits, fines, compromise of the corporate network, data loss, disruption of production processes, and other negative outcomes. At the same time, following basic digital hygiene rules can significantly reduce the likelihood of a successful attack. For example, attentiveness and caution are often enough to avoid becoming a victim of phishing,” notes Maxim Ruban.
Let's take a closer look at the most common threats.
Phishing and Social Engineering
Phishing remains one of the most common methods of compromising corporate data. Its goal is to obtain a user's confidential information by impersonating a trusted source: a bank, government institution, colleague, supplier, or another organization the employee interacts with as part of their work.
A phishing message may contain:
- a link to a fake login page;
- an attachment containing malicious code;
- a request to urgently transfer funds;
- a request to provide account credentials or confidential business information.
Social engineering is a more sophisticated variation of such attacks. Before launching an attack, cybercriminals study publicly available information about a company and its employees, analyze the communication style of managers and internal correspondence. They then exploit authority, urgency, or psychological pressure to persuade an employee to take a specific action.
According to various studies, more than half of organizations have experienced phishing attacks, and in approximately one-third of cases employees clicked on malicious links, creating a risk of corporate infrastructure compromise.
Ransomware
Ransomware is malicious software that encrypts data on an infected device and blocks access to files. Cybercriminals then demand a ransom payment in exchange for a decryption key.
Modern ransomware groups increasingly use a double extortion strategy. Before launching encryption, they copy an organization's confidential data and then threaten to publish it if the victim refuses to pay.
For businesses, the consequences of such attacks extend far beyond a simple disruption of information systems. An organization may face:
- the suspension of critical business processes;
- the leakage of trade secrets;
- the compromise of internal documentation;
- the disclosure of employee and customer personal data;
- violations of Federal Law No. 152-FZ “On Personal Data”;
- financial and reputational losses.
Credential Stuffing and Brute-Force Attacks
Brute-force attacks are aimed at gaining access to user accounts through the automated guessing of different login and password combinations.
To improve their chances of success, attackers use data from previously compromised databases as well as information available from public sources. The most common sources include:
- data breaches;
- default or preconfigured user accounts;
- simple and commonly used passwords such as 123456 or qwerty.
Organizations whose infrastructure lacks basic security controls face particularly high risks. Common issues include:
- the absence of account lockout mechanisms after multiple failed login attempts;
- the absence of two-factor authentication;
- weak password management policies;
- the reuse of identical passwords across different systems.
When such weaknesses exist, attackers may gain access to a corporate account within just a few hours.
Exploitation of Vulnerabilities in Outdated Software
Software developers regularly release security updates to fix discovered vulnerabilities. However, many organizations postpone updates or continue using unsupported versions of operating systems and applications.
This practice creates favorable conditions for attackers. Once information about a vulnerability becomes publicly available, ready-made exploitation tools often appear. As a result, conducting an attack becomes possible even for individuals with minimal technical expertise.
Using outdated software can lead to:
- unauthorized access to corporate systems;
- the installation of malicious software;
- the compromise of confidential information;
- disruptions to critical services;
- further escalation of attacks within the corporate infrastructure.
Therefore, timely software updates and regular vulnerability management remain among the fundamental requirements for maintaining information security within an organization.
Basic Steps to Protect Your Business
Protection against cyber threats does not require major investments. It is enough to start with simple digital hygiene practices:
✅ Enable two-factor authentication (2FA) on all external services: email, cloud platforms, CRM systems, management panels - anywhere users log in with a username and password. Even if a password is compromised, two-factor authentication can stop an attack.
✅ Implement a regular password rotation policy
Create clear rules for employees and establish important restrictions:
- using simple password combinations;
- reusing previously used passwords;
- using identical passwords across different information systems and services.
✅ Prohibit the installation of third-party software without prior approval from the IT department. Any uncertified application may contain malicious code and become a channel for data leakage. Centralized software installation under administrator control helps minimize the risks described above.
✅ Configure automatic updates for operating systems and critical software
Security patches fix known vulnerabilities. Any delay in applying updates expands the attack surface of the IT environment. If automation is not possible, assign responsibility for updates to a specific employee.
How to Encourage Employees to Follow Digital Hygiene Practices
According to Maxim Ruban, Head of Information Security at the eXpress corporate communications platform, for employees not only to know digital security rules but also to follow them in practice, companies need to work in two directions simultaneously: use secure digital tools and provide regular user training.
Implementing Secure Digital Tools
The first step is using communication platforms with a high level of information security. Modern corporate messengers and video conferencing solutions should provide basic protection mechanisms:
- alerts about suspicious senders;
- role-based access control and user permission management;
- antivirus scanning of files and attachments.
Such tools help reduce the risk of human error and prevent some attacks before a user performs a potentially dangerous action.
For example, in the eXpress messenger, user accounts can be linked to a corporate directory, and access can be quickly revoked when an employee leaves the company or changes roles. This helps centrally manage user access and control the entire account lifecycle, reducing risks associated with the human factor.
Employee Training and Cybersecurity Exercises
However, technology alone cannot completely eliminate the human factor. Employees need to understand what threats exist, why they are dangerous, and how to act when suspicious situations arise.
To increase awareness, companies use regular newsletters, webinars, training materials, thematic sessions, and onboarding programs.
“The effectiveness of training should be tested in practice. Simulated attacks, such as controlled phishing campaigns, are particularly useful for this purpose. This approach helps employees gain personal experience, which plays a key role in digital security,” notes Maxim Ruban.
Practical exercises reinforce skills much more effectively than theory alone. If an employee has already encountered a simulated phishing email or a malicious QR code during training, the likelihood that they will recognize a real threat and report it to the security team becomes significantly higher.
