Most small business owners know a cyberattack could disrupt their operations. But they may not realize just how expensive that disruption could be.
Verizon Business’s 2026 Breach Impact Study (BIS) looked at about 70,000 cyber insurance claims, of which more than half (38,000) were paid to policyholders to cover insurable cyber incidents from January 2019 through October 2025.
Cybersecurity Apocalypse
The news is not good — the median cost of a cyber breach has almost doubled since 2019. Business interruption emerged as the single largest loss driver — which Verizon says raises new questions about whether current cyber coverage reflects the true cost of an attack.
The BIS notes that companies that suffer cyberattacks face the challenge that costs often keep rolling in — sometimes for years after the actual breach, as these cases wind their way through both the courts and regulatory scrutiny.
Small Business Impact
According to the BIS, “The ratio of the impact amounts in relation to the insured revenue in the SMB segment was as high as 3% of revenue in the top 10% of cases and over 7% in the more extreme top 2.5% of cases. For SMBs, “the impact median approximates a modest $38,000.” The BIS calls the SMB median impact of about $38,000 “modest.” But for many small businesses, there’s nothing modest about a $38,000 unexpected expense.
Yes, the impact on bigger businesses is much higher. For mid-market companies, it rises to about $96,000 and to $283,000 for large enterprises. But small businesses are typically not prepared to handle the hit. BIS reports that for small businesses without insurance policies, the impact of a breach can be “very damaging.”
Outpacing Inflation
If the BIS report isn’t eye-opening enough, the cost of cyberattacks is outpacing inflation. From 2019 to 2024, the median breach cost rose 80% from $61,000 to $110,000, while U.S. CPI inflation was about 23%, showing “breach costs grew well beyond the rate of inflation.”
Where the Biggest Losses Are Coming From
The BIS report highlights three particular types of breaches that can significantly impact businesses.
Business Interruption
BIS says, “business interruption loss plays an important part in claims with high impact, [with] the highest median loss around $90,000.” Business interruption losses grew 51% from 2023 (21%) to 2024 (32%) as a total percentage of known loss types in claims.
According to the report, “Business interruption losses as a whole account for 50% of total known loss amounts in supply chain or third-party incidents.”
Third-Party Breaches
Business interruptions involving third parties, called contingent business interruption, were added to the report in 2024, and “reached 13% in its debut year, while the original category remained stable.” Verizon Business says, “With growth like this, [businesses] should consider taking steps to include the impact and influence of their third parties in any plans of operational and cyber resilience.”
Software Supply Chain Breaches
BIS defines software supply chain claims as those that “include either malware or crippling outage-inducing bugs placed on critical pieces of software. The [number] of claims of this incident type is only 2% of the total, but the impact is larger than most other breach types, with a median impact that is more than double the overall dataset ($252,666). To make matters worse, those extreme cases represent caps in coverage, not real economic loss from the victim.
Prevention and Preparation Are Key
The BIS report contains much more data than I reported here and is worth a read. Also check out the Verizon 2026 Data Breach Investigations Report (DBIR). Both are linked above.
The takeaway for small business owners is that cybersecurity isn’t just about protecting data. It’s about protecting your ability to keep operating. And as the cost of breaches continues to climb, prevention and preparation are becoming increasingly important parts of protecting your bottom line.
Rieva Lesonsky is the founder of Small Business Currents, a content company focusing on small businesses and entrepreneurship. You can find her on Twitter @Rieva, Bluesky @Rieva.bsky.social, and LinkedIn. Or email her at Rieva@SmallBusinessCurrents.com.
Photo courtesy Getty Images for Unsplash+
