Data Breaches and Small Businesses: What the 2025 Reports Show

Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and medium businesses, compared with 44% across all organizations, and third-party involvement doubled to 30% of breaches. IBM's 2025 Cost of a Data Breach report put the average time to identify and contain a breach at 241 days. Every US state has a breach notification law. The practical step for a small business is to know, before anything happens, what data it holds, where it lives and who makes the calls.

By Dr. Tennyson JohnsonOctober 2026

What the 2025 reports found

Verizon Data Breach Investigations Report (2025). Ransomware was present in 88% of breaches at small and medium businesses, compared with 44% across all organizations. Across all organizations, breaches involving a third party doubled from 15% to 30%, the median ransom paid fell to $115,000, and 64% of victims did not pay. Note that Verizon counts businesses with fewer than 1,000 employees as small, which includes firms far larger than most readers of this brief. (Verizon 2025 DBIR SMB snapshot)

IBM Cost of a Data Breach (2025). The global average cost was $4.44 million and the US average $10.22 million. Organizations took 241 days on average to identify and contain a breach. 13% reported breaches involving an AI model or application, and nearly two-thirds lacked AI governance policies. IBM's figures come mostly from larger organizations, so read the averages as a direction, not a small-business price. (CyberScoop, July 30, 2025)

Telling people is a legal duty almost everywhere

All 50 states, the District of Columbia, Puerto Rico, Guam and the US Virgin Islands have breach notification laws. They usually cover a name combined with details such as a Social Security, driver's license or financial account number, require notice without unreasonable delay, and some set fixed deadlines such as 30, 45 or 60 days. These laws are amended often. (Jackson Lewis overview, 2018)

Tax and accounting firms have an extra rule: the IRS reminds them that a security event affecting 500 or more people is generally reported to the FTC within 30 days of discovery. (IRS IR-2026-92)

Which laws apply to your business, and what you must do, are questions for your attorney.

What to have ready before anything happens

A list of the personal data you hold and where it lives.
Your vendors and what they can reach, since nearly a third of breaches now involve a third party.
Your AI tools and what client data goes into them.
Who decides, and who calls your attorney, your insurer and your clients.

The free data inventory estimator is a quick start on the first item, and the incident response guide covers the last.

This brief summarizes published reports. It is not legal advice.