Individuals and small businesses face a mix of fast-growing threats that all boil down to one theme: criminals follow money and weak defenses. This summary of top cybersecurity stories is for all users with actionable measures to protect against these and other threats.
1. Holiday shopping phishing surge
Attackers are sending a wave of fake emails and texts pretending to be big retailers (especially Amazon) and “Black Friday/Cyber Monday” deals, with phishing messages jumping several-fold in mid‑November. Many of these messages look very convincing and increasingly use AI to copy real brands’ style and logos.[1]
BET-R Actions: Never click “track package,” “special offer,” or “account locked” links in email or text; instead, open your browser and go directly to the retailer’s site or app.[1]
2. Ransomware still hammering small businesses
Recent data shows ransomware remains a top threat for small and mid‑sized companies, with many attacks starting from weak or stolen passwords or unpatched software holes. A large share of these incidents now include both encrypting data and stealing it, which raises legal and reputational risk if customer information is leaked.[2]
BET-R Actions: Update software and passwords, and maintain offline or cloud backups that are not directly accessible from everyday user accounts. Practice restoring from backup at least twice a year.[2]
3. Seasonal “party invite” malware emails
A large phishing campaign is sending fake holiday party invitations, invoice notices, and Zoom invites that trick people into installing remote access tools on their computers. Once installed, attackers can quietly control the device, steal passwords, and move deeper into home or office networks.[3]
BET-R Actions: Be suspicious of unexpected party invites or invoices with attachments or “Enable Macros/Content” prompts; if in doubt, confirm by phone or a separate email thread. Also, run reputable endpoint protection on all devices and ensure it is set to update automatically and run regular scans.[3]
4. Supply‑chain risks: Salesforce/Gainsight incident
Attackers reportedly abused a third‑party customer‑success tool (Gainsight) that connects into Salesforce, potentially copying contact and customer data from many companies at once. The issue highlights how one compromised vendor integration can expose large amounts of CRM data even if your own systems weren’t directly hacked.[4]
BET-R Actions: Limit each integration to the minimum data and permissions needed (for example “read‑only contacts” instead of full admin) and review access at least quarterly.[4]
5. Website and firewall exposure
Recent reports highlight increased exploitation of web infrastructure, including web application firewalls and content‑management systems like WordPress, using ready‑made exploit tools.[4] For small businesses, a hacked website can lead to defacement, redirects to malicious sites, or theft of customer form data.[4]
BET-R Actions: Ensure your website platform, themes, and plug‑ins are updated and remove plug‑ins you no longer need; outdated add‑ons are a common entry point.[4]
BET-R Tips to Counter Current Threats
- Regularly update operating systems, browsers, and antivirus software.
- Train staff or family members on secure online habits, phishing red flags, and privacy basics.
- Enforce strong password policies and use two-factor authentication wherever possible.
- Store sensitive data in reputable cloud services with strong security features.
- Schedule regular security audits and utilize tools for website and scam detection[6][7].
Recent Trends and Incidents
- Small businesses are now prime targets, with nearly half or more experiencing attacks and many unable to fully recover from major incidents.[12][13] Criminals see them as “high‑value, low‑security” victims that often lack full‑time IT staff and strong backups.[12][14]
- Focus investments on basics: strong passwords, multi‑factor authentication (MFA), backups, and staff awareness training.[13][15] Consider outside help from a managed IT or security provider if you don’t have internal expertise.[11]
- Reports show mobile phishing (fraud via text, messaging apps, and mobile email) jumps several‑fold during the holiday season as attackers impersonate big retailers, payment services, and shippers.[16][17] These scams increasingly use AI to look polished and “urgent,” tricking both individuals and employees using personal phones for work.[16][17]
- Never click links in unexpected “delivery issues,” “payment declined,” or “amazing deal” messages; go directly to the app or website instead.[16] For businesses, create a simple policy for staff phones (BYOD) and require screen locks and MFA on email and cloud apps.[15][16]
- Ransomware continues to hit small organizations hard, with many paying and some shutting down entirely after an attack.[12][13] Newer attacks not only encrypt data but also steal it, then threaten to publish customer information if the ransom is not paid.[18][19]
- Keep at least one backup that is offline or in a separate cloud account and test restores regularly.[13][15] Close or secure remote access (like exposed remote desktop) and turn on MFA for email, admin, and remote tools, since many attacks start with stolen or weak passwords.[12][15]
- Recent large breaches at retailers and service providers have exposed millions of people’s personal details, including contact info and identifiers like dates of birth or Social Security numbers.[18][19] Even if a small business is not directly hacked, these breaches fuel identity theft and targeted scams against both owners and their customers.[18]
- Individuals should freeze credit (or at least set up alerts), use unique passwords, and watch bank and card statements closely.[18] Small businesses should assume some customer data is “in the wild” and build processes for quickly informing customers and resetting passwords if a partner or vendor is breached.[18][19]
- Statistics show email and social‑engineering attacks remain the most common and successful methods used against small businesses, and AI tools make messages more convincing and personalized.[12][13] Attackers increasingly imitate real vendors, bosses, or accountants to push fraudulent payments or trick staff into sharing login codes.[11][17]
- Train staff to verify unusual money or data requests by a second channel (phone call, separate email) before acting, no matter how urgent the message sounds.[12][13] Use simple technical controls like email security filters, domain protection (DMARC), and role‑based access so that one compromised inbox cannot see or move all company money.[11][15]
By staying informed to the latest news and taking a few basic preventative measures, individuals and small business owners can stay ahead of these and other cyber threats.
Citations:
[1] Phishing attacks surge by 620% in the lead-up to Black Friday https://www.darktrace.com/blog/phishing-attacks-surge-by-620-in-the-lead-up-to-black-friday
[2] The Latest Small Business Ransomware Statistics (Nov … https://programs.com/resources/small-business-ransomware-stats/
[3] Phishing Campaign Uses Fake Party Invites to Deliver Remote … https://blog.knowbe4.com/phishing-campaign-uses-fake-party-invites-to-deliver-remote-access-tools
[4] Cyber News for the Week ending November 28th, 2025 – LinkedIn https://www.linkedin.com/pulse/weekly-update-cyber-news-week-ending-november-28th-dr-jason-c5ypc
[5] Latest Cybersecurity News November 2025 | Major Threats and … https://capturethebug.xyz/Blogs/Latest-Cybersecurity-News-November-2025
[6] 26 Ransomware Examples Explained in 2025 https://www.sentinelone.com/cybersecurity-101/cybersecurity/ransomware-examples/
[7] SecurityWeek: Cybersecurity News, Insights and Analysis https://www.securityweek.com
[8] Ransomware.live https://www.ransomware.live
[9] The Week in Breach News: November 12, 2025 | Kaseya https://www.kaseya.com/blog/the-week-in-breach-news-11-12-25/
[10] Security news weekly round-up – 28th November 2025 https://dev.to/ziizium/security-news-weekly-round-up-28th-november-2025-50l8
[11] SMB Cybersecurity Trends That Matter for 2025 https://www.cyberdefensemagazine.com/smb-cybersecurity-trends-that-matter-for-2025/
[12] Cyber Attacks on Small Businesses Statistics 2025 – Total Assure Blog https://totalassure.com/blog/cyber-attacks-on-small-businesses-statistics-2025
[13] Easy Small Business… https://www.strongdm.com/blog/small-business-cyber-security-statistics
[14] Must-Know Small Business Cybersecurity Statistics for 2025 https://www.bdemerson.com/article/small-business-cybersecurity-statistics
[15] Cybersecurity Tips For Small… https://purplesec.us/learn/cybersecurity-tips-for-small-business/
[16] Mobile Phishing Expected to Surge Fourfold During the Holiday … https://blog.knowbe4.com/mobile-phishing-attacks-surge-fourfold-during-the-holiday-season
[17] Ho, Ho, %@#! Reports Warn of Explosive Growth in Holiday Scams https://www.secureworld.io/industry-news/growth-in-holiday-scams
[18] Data Breaches 2025: Biggest Cybersecurity Incidents So Far https://www.pkware.com/blog/recent-data-breaches
[19] Recent Cybersecurity Attacks and Data Breaches – 2025 – Intellizence https://intellizence.com/insights/business-signals-trends/major-cyber-attacks-data-breaches-leading-companies/
[20] Holiday Rush, Cyber Crush: Why Retailers Are Prime Ransomware … https://www.morphisec.com/blog/holiday-rush-cyber-crush-why-retailers-are-prime-ransomware-targets-this-season/