Cyber-crime is costing the small-business community billions of pounds a year, according to research by the Federation of Small Businesses (FSB), which says that more than a million firms have been subjected to ‘phishing’, malware and payment scams (with businesses in the North West, South East and West Midlands most likely to suffer from cyber-threats).

The FSB (www.fsb.org.uk) says its findings show that small businesses are collectively subject to almost 10,000 cyber-attacks a day, with 20% of small firms saying that a cyber-attack was committed against their business in the two years to January 2019.

More than 7 million individual attacks were reported over the same period, equating to 9,741 per day. The annual cost of such attacks to the small-business community is estimated to be £4.5 billion, with the average cost of an attack put at £1,300.

Victims are most frequently subject to phishing attempts, with 530,000 small firms suffering from such an attack over the past two years. Hundreds of thousands of businesses also reported incidences of malware (374,000), fraudulent payment requests (301,000) and ransom-ware (260,000).

That said, 35% of small firms say they have not installed security software over the past two years, 40% do not regularly update their software, and a similar proportion do not back up their data and IT systems.

Just 47% have a strict password policy for devices.

FSB policy chairman Martin McTague said: “These findings demonstrate the sheer scale of the dangers faced by small firms in the digital arena every day.

The issue of business crime is overlooked too often — even more so of late, in this climate of sustained political uncertainty and in-action. Meaningful steps must be taken to safeguard our small firms.

“The Government should be doing more to tackle this scourge by enhancing the current policing response — including investing more in cyber up-skilling for police personnel as part of its wider recruitment push.

“The banks also have a role to play.

"They should be building as much resilience as possible into banking and payment systems, and they should be made liable for the losses of business customers — not just consumers — when they fall victim to cyber-crime.”