Small businesses are tempting targets for cybercriminals, mostly because they do little to protect themselves.