Last month, a small electronics shop in Gikomba lost KSh 480,000 in a single afternoon. Not to thieves. Not to fire. But to one employee clicking a fake DHL delivery email that looked just real enough.

The owner thought his backup system was fine—until the hackers encrypted every file and demanded KSh 150,000 via M-Pesa to unlock it. He didn’t pay. Instead, he rebuilt from scratch, losing months of customer records, supplier invoices, and payroll data.

If you think that can’t happen to you, think again. Cybercriminals don’t target big corporations—they go after the businesses that look easiest to crack. And guess who looks easiest? Too many Kenyan SMEs right now.