Smaller firms were prominent among those suffering the largest losses relative to size of business. For micro firms with under ten employees, the median cost of all attacks this year was just over $8,000. But at the 95th percentile and beyond there were firms suffering losses of $308,000. Some encountered still worse outcomes. One German business services firm experienced breaches costing the equivalent of $474,000 per employee.

Phishing emails were the number one way in for the extortionists. Almost two-thirds (65%) of ransomware victims mentioned this method of entry – still more in The Netherlands and Germany (76% and 74% respectively). Smaller companies fell prey to phishing more often than the rest. Some 74% of firms with fewer than ten employees targeted with ransomware mentioned this point of entry. That compares with just 65% among the biggest firms in our study.