I quite regularly hear clients and non-clients alike boldly proclaim their website is safe because it's small and insignificant. It doesn't have sensitive data such as credit card or social numbers on it. The reality is quite different.
The 3 main hacking reasons
Malicious "joyriders"
For want of a better term (and to be polite!) I'll liken them to someone who steals your car, races it round town, then crashes it into something and runs off. These hackers are in it to either hack you because you're there, to see if they can, or to deface your site, either with nasty stuff or to promote something that's "dear" to them.
This sort of hacking is usually very evident when you, or you client, visit the site.
Data thieves
These hackers are out for information, stuff they can either make use of - credit card details, social numbers, etc - or stuff they can sell - proprietary info, membership lists, etc. Unlike the "joyriders", being hacked like this is often hidden and goes undetected for quite some time. Recent examples of this are the wll known fiasco at Target, and, even more recently, Dairy Queen.
"Mule" trainers
Again, some literary license
When you're down, sing louder!