“It won’t happen to us” and other things Gloucestershire business owners say before a cyber breach

Launching National Cyber Security Awareness Month, Nick Rowntree is hosting a free webinar for Gloucestershire SMEs.
Register now.

We are supporting the launch of National Cyber Awareness Month in October with a free webinar on 1^st October that is jointly hosted by the Gloucestershire Growth Hub, to show small businesses how to reduce their risk of an AI-powered cyber crime.

Register here: Cyber Attack: It won’t happen to me! And other things unsuspecting business owners say before a cyber breach

On a single day this year, we helped three separate Gloucestershire businesses deal with the fallout of a cyber breach. One of them got hacked twice.

Separate operations, different industries, the common themes; none of them were large, none of them thought it would happen to them, all of them could have prevented it.

That’s not a coincidence; it’s exactly the mindset cyber criminals are counting on in 2026

The cyber-crime myth that’s costing Gloucestershire SMEs

Ask most small business owners why they haven’t prioritised cyber security, and you’ll hear some version of the same thing: “We’re too small to be worth the effort.” Or, “hackers go after the big names like the M&S’s, the Co-op’s of the world. Not us.”

It’s an understandable assumption. It’s also completely wrong.

The April 2025 cyber-attacks on M&S and Co-op  made national headlines for good reason. The combined financial hit was estimated to be up to £500 million, M&S alone faced around £300 million in lost profit after online orders were suspended for more than six weeks.

According to the UK Parliament’s Business and Trade Sub-Committee, both organisations were compromised through what was described at the time as ‘sophisticated social engineering tactics’ a euphemism for impersonation. But scroll past the headlines and the actual method of attack is rather simple.

The hearings found the attackers got in by phoning an IT help desk, successfully impersonating a member of staff, and simply asked for a password reset for a valid user account, with multi-factor authentication switched off.

No firewall was breached, no code was cracked, somebody just rang in, asked nicely, and someone else said yes.

The Co-op said the cyber-attack cost it at least £206m in lost revenues, while M&S also endured significant operational shutdown, long-term disruption to its online business and reputational damage.

While these examples are from leading high street retailers, the method used in both cases demonstrates that cyber-crime doesn’t have to be a big-business problem. The same attack method can just as easily be applied to a small business.

At its core, it’s not a technology problem, it’s a people problem and small businesses, often without a dedicated IT or security team double-checking every request it receives, are powered by their people. Sadly, this makes them softer targets, not harder ones.

The numbers Gloucestershire business owners need to see

According to the UK Government’s own Cyber Security Breaches Survey, 43% of UK businesses reported a cyber breach or attack in the last 12 months with SMEs among the worst affected.

Phishing remains the most common attack method by far, and where a cyber-crime did occur, the overwhelming majority started with a phishing email.

Locally, the picture is no different. As mentioned, own team dealt with three Gloucestershire breaches in a single day. Small, independent, family-run these businesses weren’t hit becasue they were household names, they could just as easily have been on the next floor, on the same business park, or worse, in your supply chain.

Why ‘small’ makes you a target for cyber attacks, not an exception

Cyber criminals aren’t romantics chasing the biggest prize. They’re running a numbers game, and small businesses tend to offer exactly the conditions they’re looking for:

• Lower pain thresholds: A smaller business often can’t absorb a week of downtime, a locked system, or a ransom demand the way a large corporate can. This means SMEs are more likely to pay and pay quickly.
• Fewer safety nets: No dedicated IT security team scrutinising every request. No formal process for verifying an urgent payment or password reset means fraudulent requests can get through more easily.
• More to lose, proportionally: Although relatively low, the average cost of a cyber incident can have a bigger impact for a small business in a way it doesn’t for a national retailer with a balance sheet built to absorb the shock.
• A way into someone bigger: Many SMEs sit within a supply chain. This means a single compromised login at a small supplier can be the doorway into a much larger, more lucrative target.

None of this requires an attacker to be a criminal mastermind. It just requires one of your team to be busy, distracted, or trying to be helpful on the wrong day.

What thinking it won’t happen to us actually costs

Unlike the Co-op, the businesses affected by a cyber breach don’t just lose data in some abstract, technical sense. They lose production time, trust, and much-needed cash chasing down what has been accessed. Then there is the job of notifying customers, rebuilding systems, and sometimes, doing it all over again a second time.

The real cost of assuming cyber security is either a big business issue, or somebody else’s problem isn’t restricted to the balance sheet. The time and trust lost can both add up.

This year is the time to start treating it seriously. Register for our free webinar today.

Hear about cyber security from the experts

If you run, or help run, a Gloucestershire SME, this free webinar is for you.

System 15 director Nick Rowntree is joining Gloucestershire Growth Hub for a practical webinar that demonstrates exactly how and when these attacks happen, what the warning signs look like, and, most importantly, what you can do straight away to protect your business from a cyber-attack.

You’ll leave with a clear picture of the current threat landscape, the attack methods most likely to catch out a busy SME, and a practical checklist you can act on immediately. There will be no jargon, no scaremongering, just a session on what actually works.