Small UK firms count the cost of cybercrime