Author
Ciberseguridad720
Editorial Team
Imagine this: you get up, switch on your computer and can't access the invoicing system; emails aren't arriving, orders are stuck and, from some corner of the world, someone has compromised your entire operation. The worst part is that you hadn't even noticed anything was wrong.
This is not science fiction; it is what is happening today to hundreds of companies like yours. Because, even if they don't make the news every day, SMEs have become cybercriminals' favourite target. Why? Because they are usually less protected and, on top of that, they often think "that only happens to the big ones".
In this article I will tell you five real stories that have taken place in recent months. They are attacks on small and medium-sized companies that believed they were safe and are now trying to rebuild their operations, their reputation… and their confidence.
The most important thing here is not to create fear but awareness. Because, with the right information, these attacks can be prevented.
In Cáceres, a criminal network managed to defraud several small businesses and individuals of more than €1.6 million through a dangerous combination of social engineering, emotional manipulation and digital identity theft.
It all started with a type of fraud known as Business Email Compromise (BEC), in which criminals gain access to corporate email accounts, either through phishing techniques or by exploiting weak passwords. Once inside, they watch communications between companies for weeks or even months without being detected. They wait for the right moment to step in: when there is a pending payment, an invoice to process or an international transaction under way.
In this case, the fraudsters subtly changed the bank details on attached invoices, redirecting payments to their own accounts. But they did not stop at the business sphere: they also used seduction and emotional manipulation tactics, known as "romance scams", to win the trust of individual victims and convince them to make transfers under sentimental pretexts.
The fraud was detected when several victims began to notice inconsistencies in payments and, in some cases, when suppliers claimed amounts that had supposedly already been paid. By then it was too late: the money had been transferred to accounts abroad and laundered through cryptocurrencies.
The mistake: this type of attack largely exploits the lack of verification protocols in payment processes. For example:
Not confirming changes to bank details through another channel (phone, Teams, etc.).
Not having a clear policy for reviewing suspicious transactions.
Using weak or reused passwords for email services.
Not using multi-factor authentication (MFA) to access corporate accounts.
The impact: in addition to the direct financial losses, the reputational impact was considerable. Supplier companies lost trust in their clients, and several individual victims reported psychological harm from the manipulation they suffered. The Guardia Civil arrested fifteen people, but much of the money has not been recovered.
Lesson learned: email is often trusted too much as a "secure" channel, and business processes are not reviewed from a cybersecurity point of view. This case shows that attackers look not only for technical vulnerabilities but also for emotional and operational ones.
Logaritme is a Catalan company specialising in the logistics and distribution of healthcare products for public and private health centres. In 2024 it fell victim to a ransomware attack that completely paralysed its operations for several days and jeopardised the supply of medical material in the region.
The incident began silently: the attackers managed to access the company's internal network, possibly through a phishing email or a vulnerability in an exposed server. Once inside, they encrypted all critical files and disabled the order, inventory and transport management systems. The ransom note demanded between one and three million euros in exchange for the key to restore the data.
Although patient data was not compromised, the personal and banking data of at least 300 employees was leaked on the dark web. The systems took several days to restore, during which hospitals had to resort to contingency plans to avoid shortages of medicines, surgical supplies and protective equipment.
The mistake: this kind of attack can largely be prevented with relatively simple measures that are still uncommon in many SMEs:
Not having disconnected backups (offline or in the cloud) that are properly tested.
A lack of internal network segmentation, which allowed the attackers to move laterally with ease.
Unpatched operating systems or applications, which leave known doors open.
No incident response plan to act quickly in the event of an intrusion.
The impact: the impact was immediate and wide-ranging: supply chain disruption, significant financial losses, reputational damage, a personal data breach and higher operating costs. The trust of its partners and clients was affected, and the company had to invest in strengthening its cybersecurity infrastructure after the attack.
Lesson learned: ransomware is no longer a threat reserved for large corporations. Companies in critical sectors such as healthcare, energy or logistics must assume they are a priority target, and prepare accordingly. Having backups is not enough: they must be protected, up to date and ready to be restored at any time.
Between April and May 2025, several supermarket and retail chains in the United Kingdom, including Co-op and Marks & Spencer (M&S), were hit by a coordinated cyberattack attributed to the hacktivist group DragonForce Malaysia. Although its motivations were mainly ideological, the effects were deeply commercial: operational disruption, systems taken offline and a risk of data exposure.
In Co-op's case, the incident was detected after a series of failures in the inventory and logistics management system that prevented orders from being processed in several stores. As a precaution, the company decided to isolate some of its critical systems, which caused supply delays and temporarily affected normal operations.
Although no leak of personal or financial data was publicly confirmed, internal sources revealed that internal systems were accessed that managed communications between suppliers, warehouses and points of sale. Marks & Spencer also suffered disruption, although less severe, mainly in secondary systems related to digital operations.
The mistake: attacks like this expose weaknesses that are common in companies with complex IT structures but limited resources for cyber defence:
A lack of proactive monitoring to detect anomalous behaviour in real time.
No adequate segmentation between internal networks and public or exposed services.
Underestimating the risk posed by activist or geopolitical groups, which may have goals very different from financial gain.
No drills or up-to-date business continuity and incident response plans.
The impact: the disruption did not affect IT systems alone: there were delivery delays, customer frustration and more pressure on internal teams. In addition, the reputational damage was significant, especially for companies with established brands and a large customer base.
Lesson learned: although the affected companies are larger than many SMEs, the message is clear: cyberattacks don't discriminate by size but by exposure. Any company that depends on digital systems, however small, needs to be prepared. Even a stock or logistics system can become an Achilles' heel if it is not properly protected.
In this case, a small Spanish e-commerce company was hit by a distributed denial-of-service (DDoS) attack that took its website down for more than six hours in the middle of the sales season. The attack was orchestrated using thousands of compromised IoT devices — such as security cameras, home routers and smart assistants — that sent massive numbers of requests to the online shop's server, saturating it until it collapsed.
The outage was detected quickly, but it could not be mitigated fast enough, because the company had no specialised protection service against this type of threat. During those hours no orders were processed, revenue was lost and several customers took to social media to complain about the sudden outage.
A later investigation found that the attack had no direct financial goal (there was no extortion) but was part of an automated campaign that hit multiple small sites in the retail sector. Even so, the effects were devastating for a company that depends exclusively on its digital channel to sell.
The mistake: DDoS attacks are increasingly accessible and frequent, and many companies make the mistake of thinking that only large platforms are targets. In this case, the most obvious mistakes were:
Not having a malicious traffic mitigation service, either from the hosting provider or an external provider.
Relying on a single server with no load balancing or redundancy.
No contingency plan to inform customers quickly and redirect sales to other channels (marketplaces, social media, etc.).
A lack of technical knowledge to tell a normal technical outage from a deliberate attack.
The impact: the immediate consequence was the direct loss of sales, especially painful on a key day of the sales campaign. On top of that came significant reputational damage, as some customers interpreted the outage as a lack of professionalism or poor organisation. The company also had to invest in infrastructure and protection services to prevent it from happening again.
Lesson learned: having an online presence is not enough: you have to protect it. For many SMEs, a website is today their main shop window and sales channel. Ignoring risks such as DDoS attacks is like opening a physical shop without a lock. Cybersecurity is not a luxury but part of the operating cost of being on the internet.
In May 2023 a critical vulnerability was found in MOVEit Transfer, a tool widely used by companies of all sizes to transfer sensitive files securely. Although the incident began in 2023, its effects extended through 2024 and 2025, affecting more than 2,700 organisations worldwide, including many Spanish SMEs.
The flaw was exploited by a group of cybercriminals who, through an unauthenticated SQL injection, gained access to the servers where the files were stored. Once inside, they downloaded sensitive data including personal, financial, health and corporate information, depending on the type of organisation attacked.
Many of the affected companies did not learn of the breach until weeks later, when they were notified by their suppliers or appeared publicly listed as victims. In some cases the stolen data was leaked or sold on the dark web, forcing companies to start notifying clients, employees and data protection authorities.
The mistake: the scale of this breach highlights a series of common mistakes, even among companies that believe they "use secure software":
Not applying the security patches published by the vendor in time after the initial warning.
Trusting "trusted" tools without proactive monitoring systems that alert to anomalous behaviour.
No contingency plans for data breaches, which delayed the response and amplified the damage.
Using software without assessing the risks of exposing it in public or misconfigured environments.
The impact: the damage was very varied: from the loss of critical information to complaints for breaching data protection regulations, as well as the loss of commercial contracts and high remediation costs. For many SMEs this incident was a turning point: a reminder that having tools is not enough; you have to know how to manage them and keep them secure.
Lesson learned: trust in software cannot be blind. Even tools designed to protect us can become attack vectors if they are not kept up to date and properly configured. This case shows that cybersecurity is not just a matter of technology but of processes, culture and constant vigilance.
These five cases are just a sample of what is happening every day in real companies of all sizes and sectors. None of them thought it could happen to them; they never imagined that their email, their website, their trusted software or their internal processes could become entry points for a cyberattack. And yet it happened.
The important thing is not to panic but to prepare. Cybersecurity doesn't have to be complex or expensive, but it must be proactive, conscious and adapted to each business's reality. With small changes, many of these situations could have been avoided.
If you run a company or are part of one, and while reading this you asked yourself "what if it happened to us?", now may be a good time to act.
I have prepared a simple, free guide with practical actions you can implement to reduce the risk of these five types of attack.
(No forms, no cost, no commitment. Just to help.)
Because, in the end, protecting your business is not just a technical matter: it is taking care of what you have built with so much effort.
Keep exploring the same topic with more practical reads already available in the blog.
How attackers hijack Meta Business accounts through phishing and session cookie theft, drain ad budgets and scam customers, and how SMEs can stop them.
Ciberseguridad720
Editorial Team
Reused passwords, phishing clicks, shadow IT, skipped updates: the 10 human errors behind most cyber incidents in SMEs and how to prevent each one.
Ciberseguridad720
Editorial Team
White, black and grey hat hackers, hacktivists and APT groups: who attacks companies, what drives them and why SMEs are increasingly in their sights.
Ciberseguridad720
Editorial Team