---
title: "Why Hackers Have Focused So Heavily on the US Small Business Administration | DuoCircle"
description: "The US Small Business Administration (SBA) does the important work of supporting small businesses in the US."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/"
---

Quick Answer

Attackers targeted the US Small Business Administration because COVID-era emergency loans pushed enormous amounts of money through SBA channels with rushed onboarding and distracted recipients. Malwarebytes documented three waves of SBA-themed phishing in 2020: April messages impersonating SBA disaster-grant forms to deliver malware, a second wave claiming approved applications and prompting a click-through to a funding portal, and an August wave with attached forms requesting personal and bank-account details. CISA issued an alert about credential theft against SBA loan-relief accounts. Small business owners were easy marks because they were stretched thin and had thin defenses, so the practical countermeasure is inbox-level phishing protection that stops the lure before a stressed owner clicks.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fwhy-hackers-have-focused-so-heavily-on-the-us-small-business-administration%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Why%20Hackers%20Have%20Focused%20So%20Heavily%20on%20the%20US%20Small%20Business%20Administration&url=undefined%2Fblog%2Fphishing-protection%2Fwhy-hackers-have-focused-so-heavily-on-the-us-small-business-administration%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fwhy-hackers-have-focused-so-heavily-on-the-us-small-business-administration%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fwhy-hackers-have-focused-so-heavily-on-the-us-small-business-administration%2F&title=Why%20Hackers%20Have%20Focused%20So%20Heavily%20on%20the%20US%20Small%20Business%20Administration "Share on Reddit") [ ](mailto:?subject=Why%20Hackers%20Have%20Focused%20So%20Heavily%20on%20the%20US%20Small%20Business%20Administration&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fwhy-hackers-have-focused-so-heavily-on-the-us-small-business-administration%2F "Share via Email") 

![Hackers](https://media.mailhop.org/duocircle/images/2020/08/spf-validator-2248.jpg) 

_The US [Small Business Administration](https://www.sba.gov/) (SBA) does the important work of supporting small businesses in the US_. They provide a lot of resources, but none more important than small business loans. And with the onset of COVID-19, the organization has come up with unprecedented emergency financial relief options for small businesses. And of course, with that much money being made available, _it was only a matter of time before hackers tried to get their hands on it_.

What has transpired is a never-ending siege of **phishing attacks** targeted at the SBA and the small businesses that use it. According to a study by [Malwarebytes](https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/), “_The phishing emails impersonate the US Small Business Administration (SBA)_, and are aimed at delivering malware, stealing user credentials or committing financial fraud. In each of these campaigns, criminals are spoofing the sender’s email so that it looks like the official SBA’s. _This technique is very common and unfortunately often misunderstood, resulting in many successful scams_.”

The attacks have come in three waves according to [Tech Republic](https://www.techrepublic.com/article/how-phishing-attacks-have-exploited-the-us-small-business-administration/). “April saw the first round of coronavirus-related attacks designed to **deploy malware**. The emails used the SBA logo and branding and _prompted recipients to complete a grant for small business disaster assistance_.”

“Following the April campaign, the second wave of **phishing emails** appeared, complete with SBA logos and branding and claiming to be from the SBA’s Office of Disaster Assistance. Promising that the recipient’s SBA application has been approved, _the message invited them to click a button to review the funding process_.”

“Spotted by Malwarebytes in early August, the third wave of phishing emails ask the recipient to fill out an attached form for disaster loan assistance. _The user is prompted to provide both personal and financial information, specifically bank account details_. As with the other campaigns, this one uses SBA branding and sender addresses that seem to come from the agency.”

[![cybersecurity](https://media.mailhop.org/duocircle/images/2020/08/spf-record-generator-2251.jpg)](https://media.mailhop.org/duocircle/images/2020/08/spf-record-generator-2251.jpg)

Things have gotten so bad, “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday released an alert about **phishing attacks** targeting various government organizations to steal logins for the Small Business Administration COVID-19 loan relief accounts,” according to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/cisa-alerts-of-phishing-attack-targeting-sba-loan-relief-accounts/).

The one thing that most of these small businesses have in common is very **poor cyber defenses** to combat this onslaught of phishing attacks. _Most business owners are so distracted, it’s not surprising that they don’t spot the phishing emails_. And even though they probably don’t think it’s important, perhaps the best thing these small business owners can do right now is to deploy **Phishing Protection** software from [DuoCircle](/).

What would keep these small business owners from deploying email security? Time and money. They probably think it takes a long time and costs a lot. And that’s the beauty of [Phishing Protection](/email/phishing-protection). _It sets up in 10 minutes and only costs pennies per employee per month_.

It’s hard to get a small business owner’s attention now, especially when they’re scrambling to find money just to stay afloat. But if there was ever a reason to _take a small amount of time and make a small investment in the future of their business_, Phishing Protection is it. If you’re a small business owner, or you know one, tell them about _Phishing Protection_. And also tell them they can try it **free for 60 days**. That ought to help.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Why Hackers Have Focused So Heavily on the US Small Business Administration","description":"The US Small Business Administration (SBA) does the important work of supporting small businesses in the US.","url":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/","datePublished":"2020-08-21T02:57:38.000Z","dateModified":"2025-05-23T17:24:23.000Z","dateCreated":"2020-08-21T02:57:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/"},"articleSection":"phishing-protection","keywords":"","wordCount":551,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/08/spf-validator-2248.jpg","caption":"Hackers","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Why Hackers Have Focused So Heavily on the US Small Business Administration","item":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Why Hackers Have Focused So Heavily on the US Small Business Administration","item":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Why Hackers Have Focused So Heavily on the US Small Business Administration","description":"The US Small Business Administration (SBA) does the important work of supporting small businesses in the US.","url":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/","datePublished":"2020-08-21T02:57:38.000Z","dateModified":"2025-05-23T17:24:23.000Z","dateCreated":"2020-08-21T02:57:38.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/why-hackers-have-focused-so-heavily-on-the-us-small-business-administration/"},"articleSection":"phishing-protection","keywords":"","wordCount":551,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/08/spf-validator-2248.jpg","caption":"Hackers","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```