Yes, small businesses can be targets of watering hole attacks, especially if they are part of a larger supply chain. Attackers may use them as a stepping stone to reach bigger organizations.