In a ground floor office nearby there is a business which has been robbed recently. Twice. Both times shortly after they moved in. Both times were, they believe, a direct result of a staff member leaving a window slightly ajar, or pulled to, but not locked. The Police explained it to them like this: every night people pass by and the semi-professional criminal looks for windows likes that, often trying them. When they find one that's open, or open enough that they can force it, they break in and grab what they can (PCs, phones, the cash-box).
Cyber crime has reached the same point today. Every day every business will receive a combination of low to mid-level threats: phishing emails and virus infected data-sticks are most common.
Having good anti-virus on every machine, reasonable network security, and most importantly teaching staff safe habits, is absolutely critical. More important stores of data require additional security. For example, off-site storage with more robust security structures. Physical security combined with IT security to prevent access to passwords via other means, and so on.
The threat is real. Read the information at this link for more details.