Small and midsized enterprises (SME) are more attractive targets because they tend to be less secure and because automation allows modern cyber criminals to mass produce attacks for little investment. Smaller companies are generally more vulnerable, as only the best companies can afford the best defenses. The Verizon Communications 2013 Data Breach Investigations Report found that close to 62% of data breaches that year were at the SME level. Small firms, with annual revenues less than $100 million, cut security spending by 20% in 2014, while large companies increased security investments by 5%.”]
Source: https://www.csoonline.com/article/2866911/why-criminals-pick-on-small-business.html