Who Do Hackers Target The Most? Real Truth About Cyber Crime. FBI vs Cyber Crime.

In this episode of Cyber Crime Junkies, host Dean Mauro explores listener question of who do hackers target the most. 

He explains the real truth about cyber crime,  recent examples of Cyber crime This year, Small business cyber attacks, and he evaluates FBI IC3 Report 2025

Growth without Interruption. Get peace of mind. Stay Competitive-Get NetGain. Contact NetGain today at 844-777-6278 or reach out online at www.NETGAINIT.com  
 

Chapters

• 0:00 FBI vs cyber crime
• 2:04 Truth about cyber crime
• 3:58 Small business cyber attacks
• 6:24 Who do hackers target the most
• 9:58 FBI IC3 Report 2025
• 14:04 Small business cybersecurity
• 16:57 How Small Businesses Are Now Primary Targets
• 21:17 Practical Cybersecurity Tips for SMBs (Simple & Actionable)
• 22:17 Real-Life Rescue Stories (Law Firm, Nonprofit, Hotel)
• 27:40 Call to Action-What Business Leaders can do

Transcript

In this episode of Cyber Crime Junkies, host Dean Mauro explores listener question of who do hackers target the most. 

He explains the real truth about cyber crime,  recent examples of Cyber crime This year, Small business cyber attacks, and he evaluates FBI IC3 Report 2025.

Topics: Tags: fbi vs cyber crime, truth about cyber crime, who do hackers target the most, Cyber crime This year, Small business cyber attacks, FBI IC3 Report 2025, Small business cybersecurity, cybercrime, ransomware, phishing, malware, business email compromise (BEC), Cybersecurity for SMBs, Cyber crime news 2025, Business email compromise explained, Ransomware attack stories, How to protect a small business from cybercrime, FBI cybercrime success stories, LockBit ransomware busted, Cybersecurity tips for business owners, Recovery Asset Team FBI, How hackers target small businesses, Real cybercrime stories, SMB cybersecurity checklist

Host (00:00.654)
you

Host (00:10.734)
After being in cybersecurity coming on three decades now, you know what the biggest cyber risk is? Overconfidence. I'm convinced of it. The belief that you haven't been breached yet. My response to that is, how do you even know? What if one phishing email could shut down your entire organization for the next 23 days? Nothing works, no access to anything. What is that going to do to you? That's the reality of it.

How about if hackers can lock up your entire network and charge you over a million dollars ransom to get your own freaking files back? Think these numbers are exaggerated? Well, you'd be wrong. Those are conservative numbers for small to mid-size organizations with fewer than 150 employees. And that's the average.

How about when a hacker halfway across the world in a country that will not prosecute her could wipe out your bank account and no one would even know until it's too late. What if I told you that cyber criminals are treating small businesses today here in the US like an all you can eat buffet and that one single email can bankrupt a company faster than any recession can.

This isn't a movie plot. This is the brutal reality of cybercrime today. I'm breaking down what the FBI just revealed in their new draw dropping new report on the state of cybercrime. Because here's the twist. Small and mid-sized organizations, not just giant companies, are becoming the biggest targets. It's happening every day and today I'm taking you deep inside

the real fight happening online right now. This is CyberCrimeJunkies, and now the show.

Host (02:12.526)
Catch us on YouTube, follow us on LinkedIn, and dive deeper at cybercrimejunkies.com. Don't just watch, be the type of person that fights back. This is Cybercrime Junkies, and now the show.

Host (02:32.791)
What if one fake email could shut down your entire business overnight? Or if hackers could lock up your entire network, all from one employee clicking on a link in an email and charge you upwards of a million dollars to get your own files back? What if that wasn't even a guarantee that you would get them back in the first place? How about when a hacker halfway across the world in a country that will not prosecute her could wipe out your entire organization's bank account?

and no one will even know about it until it's too late. What if I told you that cyber criminals are treating small to mid-sized businesses just like an all-you-can-eat buffet, and that a single email can bankrupt your organization faster than any recession or tariff challenge ever could? This isn't a movie plot. This is the brutal reality of cybercrime in 2025.

I'm breaking down what the FBI just revealed in their jaw-dropping new report. It's the report on cybercrime from the IC3. Okay, so first things first. The FBI runs something called the IC3. It's the Internet Crime Complaint Center. Think of it like a digital 911. If you get scammed, or digitally mugged, that is where your call for help goes. This past year, the IC...

The IC3 received nearly 860,000 complaints. 860,000. That's a whopping 10 to 12 % jump from the year before. And get this, victims reported losses of more than $16.6 billion. That is a record. That's like every single person in New York City losing $2,000 each.

It's crazy, right? But here's the twist that most people don't realize. Small and mid-sized businesses, not just the giant corporations, are the biggest targets. It sounds like a horror movie in some ways, but it's happening every day. And today I want to take you deep inside the real fight that's happening online right now. So welcome everybody to Cybercrime Junkies. First, if you don't know about the IC3, it's basically the FBI's Cybercrime 911. You got hacked, you got scammed, they're the ones you report into.

Host (04:57.1)
This past year, IC3 logged 860,000 complaints. And here's what's scary is that small to mid-size businesses are getting hammered the worst. Why is that? Well, small businesses are juicy targets for hackers because they usually don't have high-end cybersecurity. Think a wooden fence around your property with lots of open slats compared to a metal fortress. And the biggest threats

that small and mid-sized businesses think of organizations with fewer than 750 employees. That's basically the SMB space. And it doesn't just address private enterprise. This also includes smaller organizations, government entities, schools and the like. So what's the biggest threat that SMBs are facing? Number one was business email compromise. The FBI calls it BEC scams for business email.

The other is ransomware and extortion attacks. And the third are phishing schemes. Target individuals as well as wire transferring and other things along with business email compromise. Business email compromise alone caused 2.9 billion dozen losses for American assemblies. Imagine getting an email from what looks like your boss saying,

Hey, we need you to wire $75,000 to this vendor ASAP. I'm over at this conference. I will circle back with you tomorrow and shore up. Except that it wasn't your boss. It's a cyber criminal with a fake email address. One letter off fake email that is ghosting and mimicking, spoofing your boss's email.

It's like mistaking a fake $100 bill for a real one and only realizing it after you've already tried to spend it. Ransomware is another beast and it is by far the one that garners most of the attention. Hackers break into systems, encrypt everything and demand ransom to unlock it. And no, paying the ransom does not guarantee that you're ever gonna get your data back. In 2024, for example, the average ransomware demand and payment that was made

Host (07:16.908)
according to the FBI's recent report, was over $125,000. And that's not counting any of the recovery costs. That does not count. $125,000 on average does not include the lost business for the 20 to 30 days that the organization remained offline or the incident response in forensic and digital and

new systems that needed to be bought. None of that. All of that is on top. And when that is averaged in, it's four to six times the $125,000 that the actual cyber criminals receive in ransom. So a ransomware attack, again, doesn't just steal money. It can ultimately shut you down completely through lost trust.

lost customers and lost time. And in 2024 and recently in 2025, the first half of the year, we're seeing is oftentimes the ransomware gangs and these organized cyber crime units aren't even launching ransomware itself. It's still a ransomware like attack, but they're getting in the same way, but they're exfiltrating a fancy word for steal. They are taking and stealing the data.

that they would otherwise have encrypted and then they are extorting the organization and they're going to do the same thing that they would do, but they don't have to go through the process of even encrypting the data. Meaning they're going to notify the HHS. If you're a healthcare organization, they're going to notify the SEC. They're going to notify your customers. They're going to notify your employees and they're going to threaten to start exposing and publishing this

confidential sensitive data that they've stolen from you. It operates in the same way. The FBI calls it triple extortion or double extortion because sometimes they are either launching the ransomware and extorting or they are not launching the ransomware but they are still extorting. Either way it tends to be the same groups doing this. And again the FBI's data that was backed by sources like the SBA, Small Business Association, shows that 60 % of small businesses

Host (09:38.859)
that suffer a cyber attack go out of business within six months. That's devastating. That's six months. Some of these organizations that we've seen in the last year have literally been in business for decades. And it is something that more damaging than a recession, a pandemic or a tariff challenge that many are facing today. The cyber crime issue is a major one. And as pointed out,

Host (10:11.007)
This is Cybercrime Junkies and now the show.

Host (10:20.639)
The average time that an SMB is offline during an attack is 23 days. Picture that. Imagine not having access to your systems, not be able to engage with customers and production and delivery and invoicing for 23 days in a row. Are you prepared for that? Are you ready for that? Do you have a plan that you've practiced so you can get up and running in

two days rather than 23. A lot of this involves just the basic fundamental tenants that everyone talks about. So think of it like this. It's like being in a boxing match and getting knocked out in the first round with no comeback. When you get shut down 23 days, that's what it is. Now you might think, hey, I'm running a small commercial printer. I'm running a bakery, a plumbing company, a freelance graphic design business. Why would hackers care about

But here's the thing, small to mid-sized businesses are prime targets because big companies, right? They have armored vaults for their cybersecurity. They have internal security operations teams that are hunting down and stopping, like stopping threat actors the moment they get it, right? It's not that they don't get it. It's that they are stopped at the gate. They are stopped in and neutralized right away.

before any sensitive data gets stolen or even accessed. And that is really, really the key. And there are a lot of ways that we've talked about this in the past where small to mid-size organizations can actually get that level of support. It's just about figuring out what your needs are and allocating and having good conversations. mean, picture this. Think of it like this.

Imagine a burglar walking down the street. They're always picking the house with the open window, right? Not the one with security cameras and an angry Rottweiler sitting there. In the recent report, the IC3 report on the most recent cybercrime trends, two main factors are targeting the small mid-sized business market. Top threats to the SMBs, hackers posting as trusted partners, suppliers.

Host (12:41.481)
or even supervisors within an organization. That all falls under business email compromise, right? That is tricking employees into sending money or sending sensitive information. Total losses from BEC recently was $2.9 billion in the US. And then there's ransomware attacks, which we talked about where they lock up your files, demand money to unlock them.

And in 2024 alone, ransomware attacks rose by 18%. SMBs like doctor's offices, schools, and mom and pop shops are being hit because they can't afford what they think is really crazy expensive cybersecurity tools, or they just don't know that this stuff is available. So the average ransom payment, like we mentioned, was $125,000. that excludes does not include all of the recovery efforts, which are four to five times that amount. Imagine your laptop

All right, gets completely encrypted and then it spreads like a weed throughout your entire network. And somebody demands a certain cash amount that is ridiculously high to do it. So if you're thinking, well, I don't know if my backups were encrypted also, they claim that they are. I'll just pay the ransom and move on. Now, granted, the FBI always recommends that money not be paid to ransomware gangs and

The reason is because you don't want to fund cybercrime, also to do so can be tricky. We've had that on prior episodes to actually make a ransomware payment and to guarantee that the data has been deleted and that it's not going to be leaked and that you're paying a criminal organization that is not banned right under OFAC, which is the federal law that bans trade and funding to certain groups on

on list, you could be brought up on charges doing it. It's really delicate. It's something that clearly professionals have to handle because you want to make sure all of that is done. And some of it, cyber insurance will provide relief for and some of it it will not. That's something that needs to be addressed. But what the IC3 report talks about is that the report explains

Host (15:05.023)
that paying the ransom, at least this past year and into 2025, paying the ransom doesn't always guarantee that you get your data back. Check this out. In fact, almost one in four businesses who paid the ransom from a ransomware attack never recovered their files fully. One in four. That's crazy. So here's the wild part. Most of the attacks and most of the tactics that the cyber criminals are using,

are ridiculously simple. It's a fake email, a phishing email. There's no Hollywood level hacking involved here. Here's a couple examples. Small construction company in Texas wound up wiring $450,000 to what they thought was one of their trusted subcontractors. Turns out it was cyber criminals who slightly changed the subcontractor's email address and sent them a

identical invoice the only difference was that the wiring instructions at the bottom had been changed. One wrong click half a million dollars gone. Here's a few other real examples from the IC3 files. A small accounting firm in Chicago lost $75,000 after a phishing email tricked their payroll clerk. A nonprofit in Florida was locked out of donor records for over four weeks because of ransom.

and a custom furniture maker out in Oregon wired $250,000 for a wood shipment that didn't even exist. None of these businesses were huge, but all of them faced massive disruption. In 2025, cybercrime isn't just about stealing your grandma's Facebook account. It's full blown billion dollar war and it's organized. They operate in parts of the world that will not prosecute them.

and they are run like legitimate businesses. They have departments, they have benefits, they have promotions, they go to work in offices and call centers. This is highly sophisticated with processes and technology tools and business intelligence, just like the rest of us. We've talked before about how the cybercrime gangs operate with platforms very similar to Salesforce, where they can track their extortion campaign.

Host (17:30.251)
This is what you're up against, right? And this is why we all have to kind of rally together in public-private partnerships and let the people that know how to find these people early red hunt, attack them and be more proactive. So that way this type of stuff doesn't happen to you. It's all about cyber criminals are all about the when they walk by they're looking for the open door, right?

doing the fundamentals like shutting the door, having a guard dog, doing things like that will get them to move on past you and onto the neighbors that still have those open doors. I mean, if cybercrime were a business based on the recent numbers, it would be close to the third largest economy on the planet. When you add up the total amounts of revenue in cybercrime, it's greater than many countries. It's really, really quite.

Shocking and small businesses the backbone of the American economy are getting hammered So let's zoom in a bit small businesses and mid-sized businesses were prime targets in the past year because when you think about it They're just big enough to have some money right but small enough to not have strong cyber security defenses It's the perfect storm for cyber criminals. It's like robbing a jewelry store that

forgot to lock its door. And here's the part that people don't hear often enough. We're not just losing the fight. There have been a lot of successes in cyber defenses in the past year. Number one that we've talked about was the FBI take down of the number one most notorious ransomware gang, LockBit. LockBit was one of the world's most notorious ransomware gangs. They attacked hospitals, schools, and even US critical infrastructure.

But thanks to a global operation, including law enforcement from the United States, United Kingdom, Japan, and more, they were busted wide open. Their servers were seized. Decryption keys were distributed to victims for free and their head leaders were exposed publicly, which really undermines the entire cyber criminal ecosystem and the fact that what makes them powerful is their anonymity. One of the other,

Host (19:56.107)
Great successes in recent months was the Recovery Asset Team. It's the R.A.T. The Recovery Asset Team, part of the FBI. They wound up saving and recapturing $852 million. I don't know if you've ever heard of the Recovery Asset Team, but they're like the SWAT team for stolen money. This past year, when businesses reported cyber fraud quickly enough, the elite team from the FBI helped freeze

$852 million worth of fraudulent transactions before the cyber criminals could cash it out. One real case, a small engineering firm almost wired $200,000 to a group of cyber criminals. They reported it immediately. The recovery asset team jumped in and froze the transaction, saving the business from that financial disaster.

Host (20:53.055)
This is Cybercrime Junkies, and now the show.

Host (21:02.791)
Another success that occurred in the past year was the taking down of online marketplaces. The FBI, working with international partners, dismantled the slew of dark web marketplaces. These dark web marketplaces operate just like Amazon on the regular web. But in the dark web, they sell everything you can think of that would be illegal. Everything from drugs, guns, violence for hire. But also they sell ransomware, they sell vulnerabilities, they sell

session cookies when certain initial hackers that don't want to ultimately hurt you, they're called initial access brokers, they'll go in and they will break into your organization, but nobody knows about it because they're undetected. And then they will sell that access. Oftentimes if they leverage a vulnerability and like a browser extension or they socially engineer somebody, they're able to get all of their login credentials. That is why the FBI always

recommends never to click the remember me or anything that keeps your session open. Yes, it's convenient, but those have those are often for sale on the dark web in these dark web marketplaces. The other thing to consider here is remember. And I invite you as always to Google this fact. How long are threat actors or hackers inside an organization's network undetected?

right? And you will find the answer there. It's a very long time. So what you have to understand is a lot of things are happening to your small to mid-sized business network that most of y'all don't have visibility into. You just don't see it because they don't knock anything offline until later when they decide they're ready to launch. And that's the difference between winding up in the news and winding up where you have to notify your customers and your

employees and it gets really expensive and really ugly. Having detection early is absolutely critical. So circling back to the successes that they've had, mean, the FBI like taking down these marketplaces that were selling stolen data, malware, ransomware tools by removing those stores. It's like cutting off the supply chain to online crime. Imagine if the black market for fake passports got completely shut down, right?

Host (23:27.161)
That's what happened here only digitally. So it was really, really successful and they're ramping up attacks like that more and more. We've seen it already this year in 2025. So what can small and mid-sized organizations do? I mean, if they want to stay out of trouble and you know you have to do some things, there's some basic things. One is prepare for the day, right? Have what's called incident response plans and a tabletop exercise.

Why is that so important? Because if you start there, then even if you don't have the cool tool sets and you don't have the skilled people helping you, at least you know on the day when something happens, you know who's going to do what when. Think of it like a living, breathing, racy document. Who's responsible for this? Hour one, you get a phone call, nothing is working. Everything is locked down. We can't access anything. We can't function. We can't sell. We can't produce. We're done. What do we do?

Who does what? Hour one. Who's accountable for it? Who needs to be consulted? Who just needs to know about it? And an hour two, the same thing. Hour three and see how it pivots and how it evolves. Day one, day two. And how fast can you practice these real life simulations that have happened to organizations just like yours in the last year? How can you manage that so that you can get back up faster? Absolutely critical. The other is to know what your risks are.

Most leaders in small mid-size organizations, they simply don't know. Like they are literally flying blind. They can't see or detect what risks are happening in their network. And they also don't understand what are all of their risks? What are their risks from physical issues with their cybersecurity risks from their network risks from their users? What's the, know, how are they quantifying? Can you put a number on it? Every department can.

your cybersecurity team can too. And that's really key. Being able to do that and then protecting those users, providing the visibility for your IT team so that they're not just monitoring your network for the basics of, you know, patching and making sure things are online or offline, but they actually are able to see bad behavior. They're able to see somebody breaking in, somebody from another country breaking in, somebody moving.

Host (25:48.953)
from one system to the next, right? They call that lateral movement. How are you detecting that? Most SMBs aren't, right? And then they wonder why they are shut down for so long. And that is what, you know, can be solved here. And then making good clear policies, right? Verifying all money transfers, a bi-phone to a verified number, verifying all release of sensitive information, you know, not acting even on the...

requests of leadership within your organization until you've confirmed it through a trusted channel, right? By text, by teams chat, whatever it is that works for you and your organization doing that, having those things in place along with the basics like password management, multifactor authentication, all of those things will reduce and greatly reduce your risks that you can get back to doing what you're really good at. Right? That's the whole point. So let me, let me,

mention a couple quick true stories that were brought up in this IC3 report. One, a law firm in California got hit with ransomware. Instead of paying, they reported it. And thanks to international operations, they got a free decryption key. They were reached by lock-bit and they were swept up in that, which was great to see. A small nonprofit in Maryland almost lost $500,000 grant to a phishing email.

The recovery asset team jump in, froze the transfer within 48 hours saving their funding. It's great to hear. And that's what proof shows that when you alert early and you detect things early, you're able to respond to this and fight back. There's a mom and pop small hotel in Florida that was locked out of their reservation system due to ransomware. Thanks to fast reporting, they got their files back all without paying a ransom.

There's a lot of ways of doing that. There's a lot of ways of negotiating cybercrime ransoms. We've talked about it often. mean, think about it. Cybercrime, it's no longer someone else's problem. It's happening to small business. It's happening to freelancers. It's happening to nonprofits. People just like you and me. If you connect to the internet, you are part of the battlefield. You know, when you get online, you enter their world. But knowledge is protection.

Host (28:12.215)
If you stay sharp, train your team, act fast when something looks suspicious, you're already way ahead of most other small midsize organizations. So hope you found this helpful. Smash the like button. Please subscribe to our channel if you haven't already. And in the comments, let us know what's the scariest cybercrime or scam you've ever seen online or that you've experienced. will.

promise to read every single story and connect the dots where we can to get everybody some help. So stay safe, stay strong and stay connected. Thanks for listening to Cybercrime Juggies.