Whatever the source, former CISA boss Chris Krebs warns that SMBs, education sector organizations, and state and local governments may be disproportionately affected as these often have fewer resources to spend on security.