Any organisation can be targeted, but finance teams, payroll staff, senior management and employees with access to sensitive information are often the primary targets.

Small and medium-sized businesses are particularly vulnerable because they may have fewer security controls and approval processes in place.