Why Cyprus SMEs are a bigger cyber target than they think

More than half of businesses in Cyprus were hit by a cyberattack or breach last year. A survey conducted for the Digital Security Authority between September and November 2025, covering 459 companies, found that 53 per cent had suffered an incident in the previous 12 months, up from 47 per cent a year earlier. On average, businesses reported one attack every eight days.

Among the affected companies, 51 per cent incurred a financial cost, averaging around €12,000. Phishing accounted for 44 per cent of incidents. The most striking figure, though, concerned those that escaped: 48 per cent believed they had been spared because their business was not a target, against 37 per cent the year before.

It is a comforting explanation. It also confuses good luck with safety.

Nobody chose you

Business owners still imagine criminals studying the market and selecting the richest company. Targeted attacks exist, but most cybercrime is far less selective. Automated tools scan thousands of systems for outdated software, weak passwords and exposed remote access. Phishing campaigns reach enormous numbers of people at almost no cost, and only a small fraction need to respond for the exercise to pay off. Nobody chose the business, but the technology chose the easiest target.

Marks & Spencer found out how far the damage can spread. Its April 2025 breach suspended online orders for several weeks, forced staff back to manual processes and exposed customer data. In its results for the year to 28 March 2026, the retailer recorded £131.3 million in costs connected directly to system recovery, risk management and specialist advice.

A hotelier in Paphos might reasonably ask what a British retailer has to do with them. The scale is certainly different, but the way damage travels through a business is pretty much the same, and it does not take long. A hotel locked out of its reservations in August, an accountant cut off from client files before a filing deadline and a retailer unable to process orders can all find themselves in serious trouble within days.

What M&S had, and what most small companies do not, was reserves, an internal security team and a crisis plan somebody had actually rehearsed.

It usually starts with an ordinary email

An incident rarely begins with anything that looks like an emergency; more often an employee opens a routine-looking message while trying to get through a dozen other tasks. It might appear to come from Microsoft asking them to confirm a password, or from a regular supplier announcing new bank details, or from the managing director needing an urgent and confidential payment before close of business.

The names are right and the tone is familiar, and often enough the request refers to a transaction that genuinely exists. At such a busy moment there is little reason to suspect that someone has been reading the company’s emails for weeks. Artificial intelligence has sharpened this further: fraudulent messages are better written than they used to be, and voice-cloning can make an urgent phone instruction sound like someone the employee has known for a long time.

Training is important, but no strategy should rely entirely on every employee recognising every suspicious message, when the attacker needs only one person to make a mistake.

The ransom is rarely the biggest cost

The first hours are usually spent limiting the damage rather than investigating its cause. Affected machines are isolated, network connections cut, remote access disabled and passwords reset. These steps are taken before anyone knows how the intrusion began because the immediate priority is to stop it spreading. In practice, the business deliberately takes itself offline, adding to the disruption already caused by the attackers.

Only then can specialists begin to establish how the intruders got in and whether data was copied, while systems are rebuilt and restored in parallel. Lawyers should advise on notifications, as under the GDPR, a personal data breach must be reported to the Commissioner for Personal Data Protection within 72 hours, a clock that runs while the business is still working out what happened.

Meanwhile salaries and fixed costs continue, orders are being lost, customers drift to competitors and management spends weeks on recovery instead of running the company.

What cyber insurance actually does

Many people think of it only as a payout following a cyber incident. Its more valuable feature is immediate access to specialists when a business has no idea where to start. The insurer brings in cybersecurity experts, forensic investigators, lawyers, data-recovery professionals and crisis-communications advisers.

Cyber insurance coverage commonly extends to business interruption, customer notification, regulatory investigations and cyber extortion.

The wording matters a great deal, though, because not every loss involving a computer falls within a cyber insurance policy. If an employee is tricked into transferring money to a fraudulent account, the payment itself typically requires specific social-engineering or crime cover, and a standard cyber policy may fund the investigation of the compromised mailbox without reimbursing a cent of the money sent.

That distinction looks technical at purchase and becomes very practical in case of a claim. Ask what the policy would cover in a real incident. This may include lost income while systems are down, problems at a cloud provider, forensic and legal costs, data restoration and social-engineering fraud. Also check the limits, waiting periods and deductibles.

Preparation is more than insurance

Insurance does not replace tested backups, multi-factor authentication, staff training, payment controls or a written response plan, and increasingly the insurers themselves take the same view.

“Insurers are asking questions now that they were not asking three years ago: whether the backups have actually been tested, whether two-factor is switched on, whether anyone has written down who to call,” said Antonis Theofanous, Director at Pitsas Insurance. “Businesses that can’t answer are finding cover harder to place.”

Changes to bank details should be verified by phone to a known number, never by replying to the email. Backups should be restored on a test basis rather than assumed to work, access to critical systems should be limited to the people who genuinely need it, and someone should already know who to call, and in what order, on the morning it happens.

Even well-run businesses get hit, and the purpose of preparation is not to eliminate every risk but to make sure that one bad Monday does not threaten the company’s survival. Every owner should be able to answer three questions: if our systems were down tomorrow, how would we keep operating, who would manage the response, and how would we pay for it?

Pitsas Insurance helps Cyprus businesses assess their cyber exposure and compare suitable cyber insurance solutions in Cyprus based on their operations, systems and individual risk profile.

This article is provided for general information and does not constitute insurance, legal or regulatory advice. Cover varies by insurer and policy wording.