What a Data Breach Really Costs a Small Business

You have probably seen the headline number. IBM's annual study put the average data breach at $4.88 million in 2024. Its 2025 report brought the global figure down to $4.44 million, while the average in the United States rose to a record $10.22 million.

Those numbers are real, but they come mostly from large organizations. That's not who we work with. Most of our clients in Door County, Kewaunee County and Green Bay are 5 to 50 person businesses, and for them the math is different. If you run a 20-person company in Door County or Green Bay, your bill will be smaller in dollars. Measured against your revenue and your cash on hand, it can be far worse. A large company absorbs a breach. A small one can close because of it.

Here is where the money actually goes when a small business is hit, and what changes the size of the bill.

Downtime is the biggest cost, and the one nobody budgets for

When systems are locked or offline, people still come to work and payroll still runs, but orders, invoices and appointments stop. For most small businesses, lost working time and lost sales outweigh everything else on this list.

A simple way to estimate your own number:

• Count the people who cannot work without your systems, and multiply by what an hour of their time costs you.
• Add the revenue you bring in per hour that depends on those systems.
• Multiply by a realistic outage. Without tested backups, recovery is measured in days, not hours.

The downtime calculator on our Resources page does this arithmetic for you.

Recovery and investigation

Someone has to find out how the attacker got in, remove them, rebuild what was damaged, and restore your data. If your backups were never tested, or the attacker deleted them too, this is where days turn into weeks.

Telling the people affected

Wisconsin law (section 134.98) requires a business that loses certain personal information about Wisconsin residents to notify them within 45 days. That covers Social Security numbers, driver's license numbers, financial account and card numbers, and biometric data. Notification takes time, letters, and often legal advice. Other rules can apply on top: the FTC Safeguards Rule for tax preparers, dealerships and other financial businesses, HIPAA for anyone handling patient data, and your card processor's PCI requirements.

Ransom is a smaller share than you might think

Verizon's 2025 breach report found ransomware in 88% of breaches at small and medium businesses, against 39% at large ones. The good news in the same report: 64% of victims did not pay, and the median ransom paid fell to $115,000. Paying never guarantees you get your data back. Not needing to pay, because your backups work, is the real goal.

Customers and trust

The cost that never shows up on an invoice is the customer who quietly moves to a competitor, or the vendor who now wants proof of your security before renewing. For a local business that runs on reputation, this can last longer than the outage.

What shrinks the bill

Most of what drives the cost is decided before the breach, not during it:

• Multi-factor sign-in everywhere. Most break-ins now use stolen passwords, and a second step stops most of them.
• Endpoint detection that someone watches. Antivirus alone misses modern attacks; a monitored system catches them in minutes, not weeks.
• Backups that are tested and that ransomware cannot reach. This is what turns a disaster into a bad day.
• A written incident plan. Knowing who to call, in what order, saves hours when every hour counts.
• Cyber insurance that matches your real controls. Insurers now ask about these controls by name, and a wrong answer can void a claim.

If you want to see where you stand, our free IT security scorecard asks the same ten questions insurers ask, and shows your score in about two minutes. If you'd rather talk it through, call us. I'd much rather spend fifteen minutes on prevention with you now than three days on recovery later.