Phishing: the real cost of one click for a Belgian SME

On a Monday morning, an employee receives an "urgent" email: an unpaid invoice, a parcel waiting, a password about to expire. They click, enter their credentials on a page that looks just like Microsoft 365 — and the damage is done. For a Belgian SME, a gesture of a few seconds can turn into weeks of disruption. Here is what one click really costs, and above all how to avoid it.

A threat that is not slowing down

The figures from the Centre for Cybersecurity Belgium (CCB) speak for themselves: more than 3.6 million phishing reports were received in the first quarter of 2026, over 40,000 a day on average — an increase of more than 50% compared with the 2025 daily average. The CCB also believes the real figure is higher, since not everyone reports suspicious messages. SMEs are not spared: attackers target a human weakness, present everywhere, rather than a specific company.

What a single click can trigger

A successful phishing email rarely opens just one door. Depending on the scenario, it can lead to:

• credential theft: the attacker gains access to an employee's mailbox, cloud or business tools;
• payment fraud: fake invoices or fake bank detail changes sent from a genuine mailbox to your customers or suppliers;
• ransomware: a booby-trapped file encrypts your data and blocks operations until it is restored;
• a personal data leak, with an obligation to notify the Data Protection Authority within 72 hours under the GDPR.

Worldwide, IBM's "Cost of a Data Breach 2025" study puts the average cost of a data breach at 4.44 million dollars, and ranks phishing among the leading initial attack vectors. That average mostly reflects large organisations and is well above what an SME would face — but it shows the order of magnitude of a poorly handled incident.

The real cost for an SME

The amount of a ransom or a diverted payment is only the visible part. The real cost also includes:

• halted operations: unusable workstations, blocked invoicing, teams waiting;
• recovery time: analysis, changing every password, restoring backups;
• damaged trust: a customer whose data leaked, a supplier who received a fake invoice;
• legal and contractual obligations: GDPR notification, but also cybersecurity requirements imposed by customers subject to NIS2.

For a small business with no in-house IT department, a few days of downtime are enough to weigh heavily on the financial year.

Why technology alone is not enough

Spam filters, multi-factor authentication and isolated backups are essential: they greatly reduce the number of messages reaching your teams and limit the damage when one slips through. But phishing messages get more polished, more personalised and more credible every year. No filter stops everything — and it is a person, not software, who makes the final decision to click.

Awareness is the most cost-effective investment

A trained team that feels comfortable reporting a doubt remains the best defence. In practice:

• run a phishing simulation: a harmless fake message measures the real click rate, with no sanctions, and lets you target awareness efforts;
• train in short, regular sessions rather than one big annual course that is quickly forgotten;
• build simple habits: check the sender's real address, be wary of urgency and pressure, never enter a password after clicking a link, and confirm any unusual payment request through a second channel (a phone call, for example);
• make reporting a no-shame reflex: the sooner the IT team is alerted, the more limited the damage. Suspicious messages can also be forwarded to suspect@safeonweb.be, the CCB's platform.

At Gigaweb, we support SMEs with their IT security and their entire infrastructure: email filtering, multi-factor authentication, backups and team awareness, so that an unfortunate click stays an incident without consequences.