Small firms prove to be weak link to hackers