Small targets, big threats in a cyber-first world

Verizon's 2025 Data Breach Report shows a sharp rise in system intrusions, ransomware, and mobile threats, with SMBs and e-commerce hit the hardest.

- SHUBHENDU PARTH

Cyberattacks on web applications, e-commerce infrastructure, and mobile-connected devices have surged globally, with small businesses disproportionately affected, according to Verizon Business's 2025 Data Breach Investigations Report (DBIR).

The DBIR analysed over 22,000 cybersecurity incidents across 139 countries, including 12,195 confirmed data breaches. The report covers the period from 1 November 2023 to 31 October 2024.

The 2025 edition revealed that system intrusion, basic web application attacks, and social engineering collectively accounted for 97% of breaches in the Asia-Pacific (APAC) region. Notably, 80% of breaches in APAC stemmed from system intrusion alone, up from 38% last year.

RANSOMWARE AND THIRD-PARTY RISKS ESCALATE

The report highlighted a concerning rise in malware-related breaches in APAC, which increased from 58% in 2024 to 83%, with ransomware appearing in 51% of all incidents. Email remained the key vector for malware distribution, underscoring vulnerabilities in phishing defence and credential management.

Globally, ransomware was involved in 44% of breaches, marking a 37% rise from the previous year. While the median ransom paid declined to USD 115,000, the financial and operational impact remained acute, especially for small and medium-sized businesses (SMBs). These businesses experienced ransomware in 88% of their breaches, compared to 39% among larger organisations.