Attack Costs Have Become Nearly Zero

Nvidia CEO Jensen Huang was targeted by foreign intelligence agencies.

In June 2025, this shocking news was reported by Bloomberg and others. There were suspicions of intelligence activities through connections with a Chinese businesswoman, prompting Nvidia to announce the start of an independent investigation. Even the head of a company valued at over $3 trillion can fall prey to the most classic method of targeting: “human relationships.”

But the real issue starts here.

In the same week, a case was reported where an IoT refrigerator was hacked and used as an entry point into a corporate network. Furthermore, it was revealed that an AI agent automatically stole 190,000 game account credentials using just one bot.

When these three pieces of news are lined up, a structure becomes apparent.

The cost of attacks has dramatically decreased.

In the past, cyberattacks were carried out by highly skilled technicians over extended periods. However, with the advent of AI agents, the automation and mass execution of attacks have become possible. How many person-months would it take for a human to steal 190,000 credentials? With AI, it can be done in a matter of days, with costs limited to electricity and API usage fees. An AI tool operating on a $5 monthly subscription can attack continuously, 24/7, without rest.

This raises a question.

When the cost of attacks becomes nearly zero, are only large corporations targeted?

The answer is NO. In fact, it’s the opposite. The lower the attack costs, the more targets that can be justified as profitable, even if only a small amount is stolen. This means that small and medium-sized enterprises (SMEs) become the primary targets.

Three Reasons SMEs Become “Tasty Targets”

1. Security Investment is Almost Zero

According to a 2024 survey by IPA (Information-technology Promotion Agency), about 40% of companies with fewer than 100 employees reported that they do not have a dedicated security officer. It’s not uncommon for companies to leave firewall settings in their default state. The case of the hacked refrigerator was simply due to the default password not being changed—similar to a burglar entering a house without a lock.

2. IoT Devices Serve as “Back Doors”

Surveillance cameras, multifunction printers, smart locks, climate controls—IoT devices are increasingly present in SME offices. The problem is that many companies are unaware that these devices are “connected to the network.” The refrigerator hacking incident demonstrated that attackers infiltrate through “the weakest security devices” rather than PCs or servers.

3. AI Enables “Brute Force in Numbers”

Traditionally, hackers avoided targeting SMEs because it seemed “not worth the effort.” However, AI agents change the game. Even if the profit per company is just 10,000 yen, attacking 1,000 companies simultaneously yields 10 million yen. The incident involving the theft of 190,000 accounts is a clear demonstration of this “brute force in numbers.” Attackers no longer select their targets; everything connected to the internet is fair game.

“So, What Should We Do?”—The Minimum Defense Line Under 30,000 Yen a Month

For SMEs, investing several million yen annually in security is unrealistic. However, having a budget of zero is fatal. The average recovery cost from ransomware attacks is approximately 15 million yen, even for SMEs (according to a Sophos 2024 survey). If a defense investment of 30,000 yen a month can mitigate a risk of 15 million yen, there’s no reason not to do it.

Below are five measures listed in order of cost, all of which can be implemented for under 8,500 yen a month.

① Systematize Security Education (0 yen)

The biggest vulnerability is human. The success rate of phishing emails is about 4% for trained employees and approximately 30% for untrained ones (according to a KnowBe4 survey). That’s a difference of over seven times.

What needs to be done is simple. Share “recent phishing incidents” in a 15-minute meeting once a month. Google’s “Phishing Quiz” is free to use. The key is to make this a regular occurrence on the first Monday of every month, rather than relying on someone’s goodwill. Institutionalize it.

② Implement Company-wide Password Management Tools (from 1,500 yen/month)

There are certainly employees using passwords like “password123” or “companyname+2024.” The theft of 190,000 credentials also stemmed from the reuse of weak passwords.

With Bitwarden, it’s free for up to five users, and about 1,500 yen per month for ten users. 1Password costs about 600 yen per user per month. This environment allows everyone to use different strong passwords at this price point. It offers the highest return on investment among measures.

③ Inventory IoT Devices and Separate Networks (about 2,000 yen or more)

First, list all “internet-connected devices” within the company. Multifunction printers, surveillance cameras, smart speakers, NAS—there are likely more than you think.

Next, separate the network of business PCs from that of IoT devices. Many commercially available routers (priced around 5,000 to 10,000 yen) have VLAN or guest network features. This alone can prevent access to business data even if the refrigerator is compromised. When converted to a monthly cost, it’s a matter of a few hundred yen to 2,000 yen.

Also, change the default passwords of all IoT devices. This is free. However, surprisingly many companies have not done this.

④ Build Automatic Backups Following the “3-2-1 Rule” (2,000 to 3,000 yen/month)

Even if ransomware encrypts data, having backups ensures that business operations do not stop. The “3-2-1 Rule” is a fundamental principle.

• 3 copies should be kept
• Stored on 2 types of media (e.g., PC and cloud)
• 1 copy should be off-site (external)

With Google Workspace Business Starter, you can get 30GB of cloud storage for 680 yen per user per month. Wasabi offers 1TB for about $6 (approximately 900 yen) per month. For a company of five, you can establish a system that allows for recovery the next day after an attack for 2,000 to 3,000 yen a month.

⑤ Apply Multi-Factor Authentication (MFA) to All Accounts (0 yen)

Google Authenticator and Microsoft Authenticator are free. Major cloud services (Google Workspace, Microsoft 365, Slack, freee, etc.) all support MFA. Setting it up takes about 10 minutes per user. The entire company can complete it in an hour.

According to a Microsoft survey, enabling MFA can prevent 99.9% of account breaches. If MFA had been set up, most of the 190,000 stolen credentials would have been rendered invalid.

Total so far: 3,500 to 8,500 yen/month.

That’s an annual cost of 40,000 to 100,000 yen. Compared to the average recovery cost of 15 million yen from ransomware attacks, that’s less than 1/150th.

“We Won’t Be Targeted” is the Biggest Risk

Nvidia’s CEO Huang is one of the most protected individuals in the world. Yet, he was targeted.

The IoT refrigerator was something no one considered a “target.” Yet, it was hacked.

The 190,000 accounts were seen as “just game accounts” by individual users. Yet, they were completely stolen by AI.

What they all have in common is the carelessness of thinking, “It won’t happen to me.”

In a world where AI has made attack costs nearly zero, the issue is not whether you will be targeted, but rather when you will be targeted. And SMEs are likely to fall before large corporations. According to data from JNSA (Japan Network Security Association), the probability that an SME can continue operations after losing credibility due to a security incident is about 60%. 40% are forced to downsize or go out of business.

What to Do Today

You don’t need to implement all five measures. Start today with just these two:

1. Enable MFA for the entire company (0 yen, completed in 1 hour)
2. Change the default passwords of IoT devices (0 yen, completed in 30 minutes)

With just these two actions, 90% of attacks can be thwarted.

The moment you think, “We’re fine,” is the most dangerous moment. Attackers’ AI does not care about the size or industry of your company. If it’s connected to the internet, it becomes a target.

For 3,500 yen a month, you can protect your company. If you have a reason not to do it, I’d like to hear it.