TPE-PME websites : why they have become the preferred entry point for ransomware

An abandoned showcase website, a plugin never updated, a password recycled for years: these are, most of the time, all that a group of cybercriminals needs to paralyse a small business. According to the latest figures reported by ANSSI, nearly half of ransomware victims in France today are microbusinesses, SMEs and mid-sized companies — and their website, often the only digital point of contact with the outside world, is regularly the entry point.

The website, a blind spot in small businesses' cybersecurity

For a long time, cybersecurity was thought of as an issue for large groups with dedicated IT departments. Microbusinesses and SMEs, for their part, most often delegate the creation of their website to an agency or a single provider, then forget it: no CMS updates, no monitoring of extensions, no tested backups. It is precisely this structural neglect that attackers prioritise, exploiting known vulnerabilities already fixed by vendors — but never applied on the client side.

According to ANSSI, the number of incidents related to data exfiltration, with or without ransomware, rose by more than 50% in one year. An increase that several specialists partly attribute to the rise of automated attack tools capable of scanning thousands of sites in search of security vulnerabilities left unpatched, without even targeting a particular company: the site is hit because it is vulnerable, not because it is targeted.

Heavy financial consequences for fragile businesses

The cost of an attack is far from trivial for a small business. According to data from the cyber maturity of microbusinesses and SMEs barometer published by Cybermalveillance.gouv.fr, the median cost of a targeted attack of medium intensity is between €50,000 and €150,000, including business interruption. At that scale, a site outage of several days can be enough to jeopardise the cash flow of a company that sells online or generates the bulk of its leads via the web.

• Ransomware, phishing and CEO fraud remain the three most common families of attacks against French SMEs.
• Unpatched application vulnerabilities (CMS, plugins, themes) are among the most common intrusion vectors on small sites.
• A site outage, even a short one, directly translates into a loss of traffic, search ranking and revenue.

Simple measures, but rarely implemented

The good news is that most opportunistic attacks target sites that do not apply any basic measures. A few habits are enough to stand out from the pool of easy targets: update the CMS and its extensions as soon as a security patch is released, limit the number of administrator accounts, enable two-factor authentication, and above all regularly test backup restorations rather than merely scheduling them. The choice of hosting provider also matters: managed hosting, with a web application firewall and monitoring of intrusion attempts, significantly reduces the exposure of a small business site.

Agencies specialising in development and SEO are increasingly including a security component in their services, alongside performance or SEO: a hacked site or one blacklisted by search engines loses visibility as surely as a poorly optimised site. This is an issue that more broadly ties into the IT challenges of small businesses, often under-equipped to face increasingly automated threats.

Frequently asked questions

Why are small businesses so heavily targeted?

Because they often combine an online presence (website, shop, contact form) with minimal protection, without a dedicated IT team to monitor and fix vulnerabilities. Automated attacks spot them as easily as a large company, for a defence cost that is generally much lower to bypass.

Is a simple site update enough to protect it?

No, but it is the most effective measure relative to its cost. It must be accompanied by tested backups, strengthened authentication and, ideally, hosting that actively monitors intrusion attempts.

What to do if a site is infected or locked by ransomware?

Isolate the site, do not pay the ransom, and report the incident on the official platform Cybermalveillance.gouv.fr, which directs to listed service providers for remediation and retains a record useful to investigations.

Sources

• UnderNews — SME cybersecurity: what the ANSSI 2026 figures reveal about the French landscape
• Adista — Cyberattacks on SMEs: why are they so vulnerable?
• WebGuard Agency — France, SMEs and ransomware in 2026

This article was written with the help of artificial intelligence. Editorial policy