Risk & Cost · 6 min read

How much does a data breach actually cost a small business?

"It probably won't happen to us" is the quiet assumption behind most small business security decisions. The numbers don't support it — small businesses aren't an afterthought for attackers, they're a preferred target, and the financial impact is disproportionately severe relative to how much most can absorb.

Small businesses are targeted more, not less

Small businesses account for roughly 43% of all cyberattacks, and an estimated 61% of small and midsize businesses experienced a breach attempt in the past year. Small businesses also receive targeted malicious email at a higher rate than any other size category — about 1 in every 323 emails sent to a small business is malicious.

The reason isn't that small businesses have more to steal. It's that they typically have fewer defenses: roughly half operate with no documented cybersecurity plan, and a large share run no endpoint protection at all. Attackers, particularly automated ones, optimize for ease of entry, not size of target.

What an incident actually costs

Figures vary by source and severity, but the range is consistently painful for a business that size:

~$254,000 — Microsoft's estimated average cost of a cyberattack targeting a small or midsize business.
$120,000–$1.24 million — Verizon's reported range for SMB breach costs, depending on severity and response time.
~$50,000 per incident — average cost specifically from Business Email Compromise (BEC) attacks, the exact kind of fraud that missing SPF/DMARC protection enables.
88% of SMB breaches involved ransomware, compared to 39% at larger organizations — small businesses are disproportionately hit with the costliest, most disruptive attack type.

The number that should actually worry you

Cost figures are abstract until you see what they translate to operationally: roughly 60% of small businesses that suffer a significant cyberattack close within six months. That's not a fine or a bad quarter — for most small businesses, a serious breach is an existential event, not a line item.

The businesses in that 60% are rarely the ones that got specifically, individually targeted by a sophisticated attacker. Most are the ones running outdated software, missing basic email authentication, or exposing a service they didn't know was publicly reachable — the same handful of things a five-minute scan checks for.

What this means practically

You don't need an enterprise security budget to materially reduce your risk. The majority of small business incidents trace back to a small, well-known set of gaps: missing email authentication (SPF/DKIM/DMARC), expired or missing SSL, outdated software with known vulnerabilities, and exposed ports or admin panels that were never meant to be public. Closing those isn't a six-figure project — it's mostly DNS records and a few configuration changes.

Find out where you actually stand

A free RapidVuln scan checks for the exact issues behind most small business breaches — in about five minutes.

Run Your Free Scan →

Sources: Entech / Microsoft SMB cyberattack cost estimate, Embroker cyberattack statistics, ElectroIQ small business cyberattack statistics, StationX small business cybersecurity statistics. Figures current as of 2025–2026 reporting; actual costs vary widely by incident.