60% of small businesses close within 6 months of a major cyber attack
Small businesses face disproportionate breach impact. Here's what it costs and how to protect your organization affordably.
IBM (Under 500)
$3.31M
Average breach cost
SMB Average
$1.6M
TechAisle estimate
Small Business
$164K
Typical small firm
Closure Rate
60%
Close within 6 months
Data breach costs for small businesses vary enormously depending on organization size, data volume, and industry. The IBM Cost of a Data Breach Report 2025 benchmarks organizations under 500 employees at $3.31 million average, but this includes mid-market companies with substantial IT infrastructure. For true small businesses with fewer than 50 employees, costs typically range from $50,000 to $200,000 — still potentially devastating when measured against revenue. The figures below represent typical ranges based on multiple data sources including IBM, TechAisle, and the National Cyber Security Alliance.
Source: IBM Cost of a Data Breach Report 2025, TechAisle SMB Security Study, National Cyber Security Alliance
Small businesses face unique cost dynamics compared to enterprises. While the IBM four-category breakdown (lost business 38%, detection 29%, post-breach 27%, notification 6%) applies broadly, the proportional impact differs significantly for smaller organizations. Here is where SMB breach money typically goes and why each category hits harder for smaller companies.
IT forensics and cleanup ($20K-$100K): Small businesses almost always need to hire external IT forensics firms because they lack internal security expertise. These firms charge $300-$500 per hour, and a typical investigation takes 200-400 hours. Unlike enterprises that have internal security teams to lead the response, SMBs are paying retail rates for incident response, making this category disproportionately expensive per employee. The forensic investigation must determine what was accessed, how the attacker gained entry, and whether data was exfiltrated — all essential for legal and regulatory compliance.
Business interruption ($30K-$500K): When systems go down, small businesses cannot absorb the revenue impact. An enterprise with diversified operations can shift work to unaffected units; a 20-person company has no such flexibility. Average downtime from a ransomware attack is 22 days for SMBs. For a business generating $5 million annually, 22 days of zero or reduced revenue represents approximately $300,000 in direct revenue loss, not counting the operational chaos of manual workarounds, missed deadlines, and disrupted customer relationships.
Customer notification ($10K-$50K): Notification costs are essentially fixed per affected individual regardless of company size. Letters, email notifications, credit monitoring services, and regulatory filings cost the same $1-$10 per person whether you are a Fortune 500 company or a 10-person firm. For a small business that stores 10,000 customer records, notification and credit monitoring can easily cost $30,000-$50,000 — a significant expense for an organization with limited cash reserves.
Legal and regulatory ($15K-$100K): Compliance fines do not scale down for small businesses. GDPR fines up to 20 million EUR, CCPA penalties of $2,500-$7,500 per violation, and HIPAA fines of $137-$68,928 per violation apply equally regardless of organization size. Legal counsel for breach response costs $300-$1,000 per hour and typically engages for 6-18 months. Small businesses often lack existing relationships with cybersecurity-experienced law firms, leading to higher initial engagement costs.
Lost customers (ongoing): Small businesses have fewer customers to lose, making each lost relationship proportionally more damaging. Research suggests that 65% of consumers lose trust in a business after a data breach, and 85% say they would not do business with a company if they had concerns about its security practices. For a small business with 200 key accounts, losing 20% of them post-breach eliminates $1 million or more in annual recurring revenue — a potentially fatal blow.
Small businesses face a different threat landscape than enterprises. While nation-state actors and advanced persistent threats target large organizations, SMBs are predominantly hit by opportunistic attacks that exploit basic security gaps. Phishing accounts for 43% of SMB breaches, making it the single largest threat vector — and one of the most preventable through employee awareness training.
Source: Verizon DBIR 2025, CrowdStrike SMB Threat Report
Lincoln College in Illinois, founded in 1865, permanently closed its doors in May 2022 after a December 2021 ransomware attack compounded existing financial challenges from COVID-19 enrollment declines. The attack encrypted critical systems during the crucial enrollment period, preventing the college from accessing institutional data needed for recruiting and retention. With enrollment already down 45% from COVID, the ransomware attack eliminated any chance of recovery. The college spent four months working to restore systems, ultimately achieving full restoration, but the damage to enrollment was irreversible. Total cost: institutional survival.
Renfrew County's municipal government suffered a ransomware attack that encrypted systems across multiple departments including paramedic services, housing, and long-term care facilities. With approximately 100 employees and limited IT staff, the county spent an estimated $500,000 on incident response, forensic investigation, and system restoration — a significant portion of its annual IT budget. Critical services were disrupted for weeks, with paramedic dispatching reverting to manual paper processes. The incident highlighted how small government organizations face enterprise-level threats with fraction-of-enterprise budgets.
The Heritage Company, a telemarketing firm with approximately 300 employees, was hit by ransomware just before Christmas 2019. The company paid the ransom but still could not fully restore operations. After spending several hundred thousand dollars on IT recovery, legal fees, and lost business, the CEO announced in a letter to employees that the company could not recover and would be laying off all staff. The business ultimately closed permanently, leaving 300 people unemployed. This case illustrates the cruel reality that even paying the ransom does not guarantee business survival for small organizations.
The good news: the most effective breach prevention controls are also the most affordable. Small businesses do not need enterprise security budgets to achieve meaningful protection. The controls below are organized by cost tier, with the free/low-cost options providing the highest ROI and addressing the most common SMB attack vectors.
Source: Industry pricing benchmarks, vendor published pricing. Last verified: April 2026.
Model your specific small business breach exposure.
Detailed ROI analysis for every security control.
Why ransomware operators increasingly target small businesses.
Breach notification requirements apply to businesses of all sizes.