The cost of a cyberattack for small businesses is one of the most underestimated risks in business today. Headlines throw around big numbers, but the actual experience is more complicated than any single figure suggests. The damage doesn’t stop when the attack does. It compounds across weeks and months, touching everything from operations to reputation to insurance premiums.
This post breaks down what those costs actually look like: where the money goes, why small businesses are disproportionately affected, and what it takes to avoid becoming part of the statistics.
Key Takeaways
- The average cost of a cyberattack for a small business ranges from $120,000 to over $1 million, depending on severity.
- Costs fall into three categories: direct (immediate response), indirect (operational disruption), and hidden (long-term damage).
- 60% of small businesses close within six months of a major data breach.
- Ransomware, phishing, and credential theft are the most common and costly attack types targeting SMBs.
- Proactive managed IT security costs significantly less than recovering from an incident.
What Does a Cyberattack Actually Cost a Small Business?
According to Verizon’s 2024 Data Breach Investigations Report, the average cost of a breach for a small business ranges from $120,000 to $1.24 million. IBM’s research puts the figure higher still — closer to $3.31 million for businesses with fewer than 500 employees when all downstream costs are factored in. Hiscox’s annual Cyber Readiness Report offers a different lens: a median annual cost of $8,300 per business, but across a median of four attacks per year.
The range is wide because so much depends on the type of attack, how quickly it’s detected, what data was accessed, and whether the business had any incident response plan in place before it happened. A phishing email that gets caught early looks nothing like a ransomware attack that shuts down operations for a week.
What the numbers agree on: the cost is almost always higher than the business expected, and it almost never stays contained to the initial incident.
The Direct Costs of Data Breach Recovery for Small Businesses
These are the expenses that show up first, aka the ones a business has to pay to stop the bleeding and get back online.
IT forensics and incident response
The first priority after an attack is understanding what happened, what was accessed, and whether the threat is still active. That requires specialist forensic investigators — and their services don’t come cheap. Forensic investigation alone can run between $15,000 and $30,000, depending on the complexity of the breach. For a business without an existing managed IT relationship, finding and onboarding that expertise in the middle of a crisis adds both time and cost.
Data recovery
Cyberattacks frequently corrupt, encrypt, or destroy business data. Recovering it — if recovery is even possible — requires specialist tools and significant labour. The cost varies based on how much data was affected and whether current backups exist. Businesses without recent, clean backups often face a choice between paying the ransom or rebuilding from scratch.
Customer notification and credit monitoring
If customer or employee data was compromised, most jurisdictions require formal notification — and in many cases, businesses are also expected to provide affected individuals with credit monitoring services. This process, including legal review of notification requirements, communications, and monitoring provision, typically costs between $20,000 and $50,000. It’s also the moment a private incident becomes a public one.
Ransom payments
Ransomware attacks lock businesses out of their own systems until a payment is made. The average ransom demand for small businesses now exceeds $10,000 — and paying it doesn’t guarantee resolution. According to Hiscox, of the small businesses that paid ransoms, only half recovered all their data, and 27% faced additional demands after the first payment. Paying the ransom is often the beginning of the cost, not the end of it.
The Indirect Costs: What You Lose Over Time
Once the immediate crisis is contained, a second wave of costs begins. These are slower to surface but often more damaging in total.
Business downtime and lost revenue
A cyberattack almost always takes systems offline. For small businesses, even a few days of disruption can mean missed orders, delayed projects, and broken client commitments. The longer the downtime, the deeper the revenue impact — and unlike a planned outage, there’s no way to prepare customers in advance.
The financial impact of a cyberattack on operations
Beyond lost revenue, the operational disruption runs deep. Staff hours are redirected to incident management instead of productive work. Leadership attention shifts away from growth and toward damage control. According to IBM, 60% of breached businesses raise their prices after a cyber incident to offset recovery costs — a move that can push price-sensitive customers toward competitors. The financial impact of a cyberattack doesn’t just hit the balance sheet once; it reshapes how the business operates for months.
Reputational damage and customer churn
A breach makes customers question whether their data is safe, and many will simply take their business elsewhere rather than wait to find out. That lost revenue rarely shows up in breach cost estimates, but it’s real and often permanent. Investors and prospective hires apply the same logic: a publicised security incident is a signal about how a business is run.
Rising insurance premiums
Experiencing a breach changes your relationship with your insurer. Premiums typically increase after an incident, particularly if the investigation reveals gaps in the business’s security posture. For businesses that didn’t have cyber insurance at the time of the attack, getting cover afterwards becomes significantly more expensive — if they can get it at all.
Legal fees and regulatory fines
Depending on the industry and the data involved, a breach can trigger regulatory investigations and significant fines. Businesses handling health data face HIPAA exposure. Any business dealing with EU customers operates under GDPR, where fines can reach into the hundreds of thousands. Add legal counsel to navigate the process and respond to any civil claims, and the legal tail of a breach can run for years.
Why Small Businesses Are Hit Hardest
Large enterprises get breached, too. The difference is that they can usually survive it.
A business with thousands of employees, dedicated security teams, legal departments, and deep reserves can absorb the cost of a breach as a line item. For a small business operating on tight margins with a lean team, the same incident can be existential. That’s not an exaggeration: studies consistently show that 60% of small businesses close within six months of a major data breach.
Small businesses are also disproportionately targeted. Cybercriminals know that SMBs typically have less sophisticated defences, less incident response capability, and more pressure to pay ransoms quickly to get back online. According to Accenture, 43% of cyberattacks are aimed at small businesses — but only 14% are prepared to defend themselves.
The asymmetry is stark: the attacks are designed for businesses like yours, but the defences often aren’t.
The Most Common Attack Types and What They Cost
Not all cyberattacks are equal. These three account for the vast majority of incidents affecting small businesses.
Small business ransomware costs
Ransomware is the most financially damaging attack type for SMBs. Criminals encrypt business data and demand payment for the decryption key. Beyond the ransom itself, small business ransomware costs include days or weeks of downtime, data recovery efforts, and in many cases, the cost of rebuilding systems entirely. Sophos’s 2023 State of Ransomware Report put the average ransomware demand at $1.54 million — nearly double the previous year.
Phishing attacks
Phishing remains the most common entry point for cyberattacks, and for good reason: it targets the most vulnerable part of any security setup, the people using it. A convincing email gets one employee to click a link or hand over credentials, and the attacker is inside the network. Hiscox found that phishing was the point of entry in 53% of ransomware incidents. The cost isn’t always dramatic, but the breach rate is consistent.
Credential theft
Stolen login credentials give attackers persistent access to business systems, often going undetected for weeks or months. During that window, they can exfiltrate data, access financial accounts, or lay the groundwork for a larger attack. For businesses using shared passwords or without multi-factor authentication, a single compromised credential can unlock the whole environment.
What a Cyberattack Costs vs. What Prevention Costs
The median cost of a cyberattack on a small business is $8,300 per incident, across a median of four incidents per year. A serious breach — ransomware, a major data exfiltration — runs into the hundreds of thousands. Against those numbers, the monthly cost of managed IT security looks less like an overhead and more like an insurance policy with an unusually good payout ratio.
Proactive managed IT support prevents the majority of incidents before they become breaches. Continuous monitoring catches anomalies early. Regular patching closes the vulnerabilities attackers look for. Security awareness training addresses the human layer that phishing depends on. None of it is free — but all of it is cheaper than the alternative.
The businesses that end up paying the most are almost always the ones that delayed the conversation about prevention.
How PRMT Helps Small Businesses Stay Protected
PRMT delivers managed IT services built around the reality that prevention is always cheaper than recovery. Our approach combines continuous monitoring, cybersecurity-first infrastructure management, and proactive threat response — so potential incidents get caught before they become costly ones.
For small and mid-sized businesses, that means access to enterprise-level security capability without the overhead of building it internally. WePRMT handles the complexity, so your team can focus on running the business, not firefighting the infrastructure.
If you’re thinking about what a breach would cost your business, it’s worth talking to us first. Get in touch with the PRMT team to find out how we can help you stay ahead of the threat.
