For years, many small and midsized businesses believed they were too small to attract serious cyber threats. That assumption no longer holds.