The 10 most common cyber attacks facing businesses

Usually through a stolen login, an unpatched VPN or firewall, or a phishing attachment.

The attacker gains admin rights and maps the network, often for days without being noticed.

HR, client and financial files are copied out to the attacker's cloud storage.

Backups are deleted or encrypted and security tools are switched off.

Systems are encrypted and a leak site threatens to publish the stolen data unless you pay.

A flaw in a popular VPN, firewall or business application is published.

Automated scanners find every exposed, unpatched device on the internet.

Attackers break in before many owners have applied the patch.

A backdoor is planted that survives the patch being applied later.

The access is used directly or sold on to a ransomware group.

The attacker uses LinkedIn and your website to learn who approves payments and who they trust.

A convincing email, text or call is prepared, often written with AI in a colleague's or supplier's style.

The message is urgent and confidential: an invoice is overdue, an account is locked, the CEO needs this today.

The target clicks, signs in on a fake page, changes bank details or approves a payment.

Money moves or the attacker now holds a working login. Recovery is hard once funds leave the country.

Logins are stolen by infostealer malware, phishing kits or old data breaches.

Bundles of passwords and session cookies are sold on criminal markets.

Buyers test the logins across many services, or replay stolen session cookies.

Repeated push prompts wear the user down, or a fake sign-in page relays the MFA code.

The attacker registers their own MFA device and adds hidden inbox rules.

The attacker breaches a software vendor, IT provider or popular code package.

Malicious code goes into an update or package, or the supplier's remote access is abused.

Customers install the signed update or approve the supplier's access as normal.

The attacker now has a foothold in many customer networks at once.

Data theft or ransomware spreads across the supplier's customer base.

A hacktivist group or extortionist picks a target, often for political reasons.

A botnet of hijacked devices and rented cloud servers is lined up.

Huge volumes of traffic or requests hit the website, network or app.

Customers cannot reach the service. Orders, bookings or payments stop.

The group posts its claim online, or an extortion email demands payment to stop.

A fake download, malicious search ad or email attachment reaches a device.

The user opens it, or a flaw runs it automatically, often entirely in memory.

Passwords, cookies and files are collected, or a backdoor is set up.

The attacker switches to normal admin and remote-access tools to avoid detection.

Stolen data is sold, the access is resold, or ransomware is deployed.

AI tools profile your company, staff and suppliers from public sources in minutes.

Flawless, tailored messages are generated for each target, in any language.

A cloned voice or deepfake video call adds pressure that is hard to question.

AI helps attackers turn newly published flaws into working exploits faster.

Hidden text in an email or file tricks a company AI assistant into leaking data.

The attacker finds a form, search box, URL or API that accepts input.

A crafted database query or script is entered in place of normal data.

The application runs the query, or stores the script and shows it to other users.

Customer records are dumped, or visitors' sessions are hijacked.

Data is sold or leaked, admin accounts are taken over, or the site serves malware.

Automated tools search the internet for exposed cameras, routers and controllers.

The attacker uses a default password or a known, unpatched flaw.

The device joins a botnet, or becomes a quiet foothold inside the network.

From a flat network, the attacker reaches servers and office PCs.

Production stops, building systems fail, or the access feeds a ransomware attack.