Credential stuffing attacks hit small and mid-sized businesses the hardest because cybercriminals bank on password reuse.

source