"We're a small company, so cyberattacks have nothing to do with us."
"We don't have any real confidential information, so we're fine."
If your company's executives or IT staff think this way, you are in a very dangerous position.
Cybercriminals have now shifted their focus decisively from large enterprises to small and medium-sized businesses. Their method is the "supply chain attack" that has been in the news.
Based on the latest statistics published by public agencies, this article explains the current cyber threats facing small and medium-sized businesses, and why every company now needs MFA (multi-factor authentication) for PC login.
1. The harsh reality, proven by data: small and medium-sized businesses are targets
The idea that "cyberattacks are something that happens to large companies" is completely outdated in today's business environment. The latest data from the National Police Agency and the Ministry of Economy, Trade and Industry (METI) reveal a shocking reality.
• About 60% of ransomware victims are small and medium-sized businesses
According to the statistics in the National Police Agency's report on the state of threats in cyberspace, about 60% of all reported cases of damage from ransomware — malware that demands a ransom and can deal a devastating blow to a company — involved small, medium-sized and micro businesses. While damage at large companies, which can budget for security, has remained flat, small and medium-sized businesses with weaker defenses are taking the brunt of the attacks.
• 70% saw damage spread to business partners (a domino effect)
In surveys by METI and IPA (Information-technology Promotion Agency, Japan), about 70% of small and medium-sized businesses that suffered a cyberattack said that "the cyber incident affected our business partners." An attack on just one company can paralyze an entire business network built up over many years.
2. Why do attackers go out of their way to target small and medium-sized businesses? Why ransomware damage is increasing
The attackers' real target, now as ever, is "large companies with vast funds and important data." But large companies invest tens of millions of yen in security, so breaking through head-on is difficult.
So the attackers first target "small and medium-sized businesses with weak security that do business with large companies."
① IDs and passwords used as a "stepping stone"
They steal the login credentials (IDs/passwords) for the remote work environments and PCs of small and medium-sized businesses, and first take over those businesses' internal systems and email accounts.
② Exploiting "trust" to attack the real target
Using the hijacked accounts, they pose as genuine staff and send emails with malware or fake invoices to the real target — the large company (such as the client that places orders). Because the message comes from "a trusted partner we always deal with," the large company opens it without suspicion, and the damage spreads.
In other words, small and medium-sized businesses are being relentlessly targeted as "stepping stones (safe entry routes)" for attacking large companies.
3. A PC login with "password only" is like a front door left unlocked
Many companies tend to think "we have antivirus software, so we're fine," but the mainstream of today's cyberattacks is not malware intrusion but the "theft or cracking of legitimate passwords."
With today's automated hacking techniques, a password made up simply of letters and numbers can be cracked in seconds to minutes.
If the login (OS logon) to the PCs employees use for work relies on "password only" authentication, then the moment it is breached, all the data on the PC, the internal network, and access to business partners all fall into the attacker's hands. It is as if "the front door to the room holding a safe full of important data were left unlocked."
The only decisive measure to prevent this and strengthen security is MFA (multi-factor authentication).
According to a Microsoft security report, enabling MFA (multi-factor authentication) can block more than 99.9% of account compromise attacks (Source: Microsoft Security Blog, August 20, 2019).
By combining two or more factors — not only a password (something you know) but also, for example, "the smartphone the employee personally carries (something you have)" — you can reliably prevent unauthorized login to the PC itself, even if a password is leaked.
4. The government and large companies are moving. "No MFA" is becoming a risk of losing business
In response to this serious situation, the government and large companies are moving quickly toward "defending the entire supply chain."
• METI's promotion of the "SCS evaluation system"
The SCS evaluation system (Japan's security evaluation system for strengthening supply chains), which visualizes and evaluates the security measures of small and medium-sized businesses to ensure the safety of the entire supply chain, is being built and rolled out.
• A wave of large companies making it a "condition of doing business"
Some large companies and government agencies have already begun requiring subcontractors and partners to "implement multi-factor authentication (MFA)" or "meet certain security standards" as a mandatory condition for continuing business.
Companies that say "we can't afford it, so security can wait" face the risk of being dropped in the near future by important business partners who tell them, "the risk is too high; we can't renew the next contract." Security measures are no longer a cost; they are "the minimum investment needed to keep the business going."
5. Simple yet strong "PC login MFA" — especially for small and medium-sized businesses
For small and medium-sized businesses without the expensive server infrastructure or dedicated IT departments of large companies, "MFA for PC login" can look like a high hurdle.
"The implementation cost is too high"
"It's hard to set up, and no one in the company understands it"
"The monthly running cost would be a burden"
The multi-factor authentication service dedicated to PC login, "applippli-key," was developed to solve all of these challenges that are specific to small and medium-sized businesses.
• No need to build a dedicated server. Just install it on the Windows PCs you already have.
• You can start small — for example, with just the PCs of executives or accounting staff.
• Even without IT staff, setup can be completed in as little as 5 minutes. Employees get strong security just by tapping once on their smartphone (one-touch login).
To protect your business partners' trust and your own business from cyber threats, why not start by considering something easy to begin with: "strengthening PC login"?
For companies considering stronger PC login authentication
"We rely on passwords alone"
"Our business partners are asking us to take security measures"
"We want to protect at least admin PCs and critical devices"
For companies like these, we offer "applippli-key," an MFA solution dedicated to PC login that can be introduced from a single PC.
It can be introduced without Active Directory or a dedicated server, and strengthens Windows login with one-touch authentication.
View details of "applippli-key"
Related article: The SCS system is coming into full force — companies without authentication measures may be excluded from supply chains
References
• National Police Agency, "The State of Threats in Cyberspace in 2025" (令和7年におけるサイバー空間をめぐる脅威の情勢等について)
• IPA (Information-technology Promotion Agency, Japan), "FY2024 Survey on Information Security Measures at Small and Medium-sized Enterprises" (2024年度 中小企業における情報セキュリティ対策に関する実態調査)
• Ministry of Economy, Trade and Industry (METI), "Security Measures Evaluation System for Strengthening Supply Chains (SCS)" (サプライチェーン強化に向けたセキュリティ対策評価制度)
• Microsoft Research, "How effective is multifactor authentication at deterring cyberattacks?"