The Real Cost of a Data Breach for Small Businesses

The Data

The 2025 NetDiligence Cyber Claims Study analyzed over 10,000 claims from 2020 to 2024, with small and medium-sized businesses making up 98% of that data. The findings:

• 5-year average total incident cost for SMEs: $246,000
• Most recent year’s average: $264,000, up roughly 30% year over year
• Crisis services alone (forensics, legal, notification): averaged $152,000 per incident
• Insurance payouts covered roughly 69% of total SME incident cost over the 5-year window

What “Crisis Services” Actually Means

Before a business even gets to the cost of lost business or any settlement, it typically has to pay for forensic investigation (figuring out what happened and how), legal counsel (figuring out what you’re required to disclose and to whom), and notification costs (actually telling affected customers or patients, often including credit monitoring). That’s the $152,000 average on its own, before anything else.

The 31% Gap

Insurance covered about 69% of total SME incident cost on average, which means roughly a third of the cost still lands on the business directly, even with a policy in place. That gap usually comes from costs outside policy limits, uninsured business interruption, reputational impact, or coverage sublimits on specific cost categories.

Why This Context Matters

Comparing an annual premium (often under $2,000 for a typical small business) to a $246,000 average incident cost is the actual math that matters more than any single statistic about cyber risk. Coverage doesn’t make a breach free, but it changes which parts of that number you’re expected to absorb alone.