Small businesses are 96% of ransomware victims in Verizon's 2026 breach report, and most had a 95-day warning sign nobody was watching for

Verizon published its 2026 Data Breach Investigations Report in May, drawing on more than 22,000 confirmed breaches across 145 countries from November 2024 through October 2025 [1][2]. The headline number sits in the ransomware section: among the breaches where the victim's size was on record, small organizations made up 96% of ransomware victims [3]. That is not a story about small businesses being singled out by name. It is a story about what gets left unpatched.

The report's other big shift backs that up. For the first time, exploiting an unpatched vulnerability overtook stolen credentials as the leading way attackers get in, at 31% versus 13% [4]. Ransomware crews are not guessing passwords one at a time anymore. They are running automated scans for software nobody updated, and a small business usually carries more of that unpatched software per person watching it than a larger one does.

The finding worth building a process around is the timing. 73% of ransomware victims had an infostealer infection or a leaked credential on record in the year before the attack, and half of those leaks surfaced within 95 days of the ransomware hitting [5]. Ninety-five days is not a warning that arrives the moment before disaster. It is a window most businesses already have, and simply are not watching.

The 2026 DBIR's scope is large enough that the 96% figure is hard to write off as a fluke of sample size: Verizon and its contributing partners analyzed over 22,000 confirmed data breaches, with CIS Controls and MS-ISAC data folded into the report's ransomware and public-sector findings ^[1][2]. The 96% share applies specifically to incidents where the victim organization's size was recorded, which covers most but not all of the dataset, and it covers ransomware rather than every kind of breach. Even with that caveat, a business under fifty employees is not statistically safer than a listed company on this data. It is the more common target.

The access-vector flip matters because it points at a fixable habit rather than an unfixable threat. Stolen credentials get the headlines because phishing is easy to picture, but at 13% of initial access they are no longer the leading cause. Exploited vulnerabilities, at 31%, mean the opening is usually a piece of internet-facing software, a plugin, a VPN appliance, a point-of-sale system, that has gone unpatched long enough for a known fix to exist and sit unapplied ^[4]. A patch cadence measured in days, not whenever someone gets to it, closes the vector doing more damage than password theft right now.

The 95-day figure comes from tracing ransomware victims backward: of those with a prior-year infostealer infection or credential leak on file, about half of those leaks happened within roughly three months of the ransomware attack itself ^[5]. That is not a number a business discovers by watching its own systems. Infostealer logs and leaked-credential dumps circulate on forums and marketplaces the victim never sees. It is a number that shows up only if something, a monitoring service, a security vendor, a basic breach-notification habit, is actually checking whether an employee's work login has turned up somewhere it should not be. Most small businesses have never run that check once, let alone on a cadence that would catch a leak inside a 95-day window.

The flip side of the report is encouraging, with a condition attached. 69% of ransomware victims refused to pay the ransom, up from roughly half a few years earlier, and reliable backups are the reason most often cited for being able to say no ^[6]. The condition is that a backup only gives a business that choice if it has actually been tested. Recovery studies outside the DBIR have found that over a third of businesses that did end up paying a ransom did so because their backups had failed or malfunctioned when they tried to use them. A backup job that completes successfully every night is not the same claim as a backup that restores a working system.

One more shift worth flagging for any business that outsources IT, payments, or a piece of its stack: third-party involvement in breaches rose to 48% of the total, up 60% year over year ^[7]. A vendor, contractor, or software supplier with access to a system is now present in roughly half of all breaches, not as a footnote but as the actual way in. Vetting a vendor once at signup and never again is not the same as knowing what access that vendor still holds two years later.

Verizon's dataset leans North American and European, and the report does not publish an Egypt- or Gulf-specific breakdown. That is a real gap, not something to paper over. What travels regardless of geography is the mechanism: automated scanning does not check a business's country before it checks whether a piece of software is patched, and a leaked password is not less dangerous because the business that issued it operates from Cairo or Dubai instead of Chicago. The fix, unpatched software, unmonitored credentials, untested backups, is the same list wherever the business is.