Cybercriminals typically don’t discriminate. Targeted campaigns like spear phishing or focused advanced persistent threats aren’t as common as mass-style attacks. Hackers often try to cast a wide net, hoping they get a hit and can exfiltrate or encrypt a company’s data for ransomware. In short, SMBs are targets because criminals target everyone.