2025 Cyber Attack Report: How Much Are Data Breaches Costing Small Businesses?

There are 2,200 cyber attacks launched each day. ^[4] The media often highlights cyber attacks on giant corporations that cost millions of dollars and expose the data of large numbers of Americans. But large companies aren’t the only targets: 61% of small businesses were attacked in 2023. ^[4] In fact, the majority of all cyber attacks are aimed at small businesses, mainly in phishing campaigns, because they are easier to infiltrate than a behemoth corporation. Data breaches and other forms of cyber attacks cost a median $46,000 in ransomware and extortion, but more than half of the victims paid more than $100,000. ^[1][3] Since 2024, cyber attacks have increased 180% due to vulnerabilities posed by various apps. ^[1] Sadly, a small business can easily go under due to a cyber attack, especially if it’s not covered with cyber insurance. Here’s more about cyber attacks and data breaches and what they are costing small businesses.

On This Page

• 

  How Do Cyber Criminals Attack Small Businesses?

• 

  What Is Phishing vs Malware?

• 

  What Exactly Is Ransomware?

• 

  Why Cyber Insurance Is Important and How Much It Costs

• 

  Do I Need Business Interruption Coverage for a Cyber Attack?

• 

  Cyber Attack Costs for Small Business FAQs

How Do Cyber Criminals Attack Small Businesses?

Ransomware and other types of extortion of cloud-based data make up nearly one third of all cyber attacks. In fact, ransomware is a top threat across 92% of all industries. Ransomware and extortion also make up 28% of all cyber attacks. ^[1] It’s estimated that 83% of victims pay the ransom. ^[3]

Roughly 92% of malware attacks are perpetrated using email, and the most common form of malware is spyware, which can steal sensitive information. ^[3]

Other attacks are often launched through third-party software and have increased by 68% in 2024 compared with 2023. ^[1]

Some threats permeate the small business’s operation through a human element, often an employee or employees who click on a bad link or are duped into giving access to networks.

Pretexting, which is when someone from the organization is deceived into giving over sensitive information or access to networks or systems, accounted for nearly a quarter of all attacks. ^[1]

VPN software can often mitigate these risks, as long as security training is given to employees to prevent them from giving attackers access to shared accounts and website applications.

What Is Phishing vs Malware?

Phishing is a deceptive way of getting sensitive information, often using malware, malicious software, which may be downloaded on your website due to clicking on a bad link. Phishing often involves the technique of getting people to click on a link in an email.

What Exactly Is Ransomware?

Ransomware is when malware is used to attack a computer or network of computers and encrypt a victim’s files. Attackers usually make it impossible to resume work on affected computers and ask for a ransom in exchange for the decryption key, often in cryptocurrency, which is difficult to track.

Why Cyber Insurance Is Important and How Much It Costs

Only 4% of businesses reported feeling confident that users of connected devices and related technologies are invulnerable to cyber attacks with the railguards they have in place. ^[4]

Cyber insurance costs $2,000 a year, on average, but prices vary widely depending on the size of the company and the size of the network. ^[5] Considering that the average cost of a data break is over $45,000, it may be a wise investment, especially if your company stores sensitive customer data.

Do I Need Business Interruption Coverage for a Cyber Attack?

Some cyber insurance policies include business interruption coverage, which only applies in cases of cyber attacks. Some policies do not have it. ^[6] If you have business interruption coverage as part of a business owners policy (BOP), make sure it does not exclude cyber attack and data breach coverage. A business may temporarily need to stop operations, so this form of coverage is very important to have to keep payroll and other expenses covered.

Even with all the guardrails in place, a sophisticated hacker may be able to launch a cyber attack against your company. Buying cyber insurance is essential to add to business insurance policy. Compare rates from dozens of insurers to find the best price at no cost, no credit card down. Just enter your zip code on this page to begin.