When cybercriminals go after big entities, they make headlines. So they've begun targeting more under-the-radar companies.