What a data breach costs a small company – and where the money goes

The question “what does a data breach cost?” is usually answered with a large average figure that says nothing about a company with twenty employees. In reality, the cost is rarely one big item. It is a series of smaller items that all fall due at once — exactly when the business is least able to handle them.

Here is where the costs sit, in the order they usually become visible.

1. Downtime

The first thing that happens in a ransomware attack or a serious compromise is that systems are shut down. Orders cannot be taken, invoices cannot be sent, production stops. For a business with thin margins, two days of downtime is often the largest single item — bigger than the recovery work itself.

Do the maths before it happens: what does one day without your two most important systems cost? The number is usually uncomfortably concrete.

2. Investigation and recovery

Understanding what happened takes time from someone who knows how. That often means external help: forensic analysis, restoration from backup, replacement of compromised accounts, rotation of keys and certificates. Even when the backup works, restoration consumes internal time that would otherwise have gone to customers.

Control question: when did you last test a restore from backup, and how long did it take?

3. Lost customers and trust

Customers who get no answer for a week start looking for alternatives. Business customers with their own compliance requirements may have to escalate you as a supplier risk — which in practice means reviews, contract changes or, in the worst case, terminated agreements.

Trust is the item that is hardest to quantify and hardest to rebuild. It is also why security work you can demonstrate has commercial value, not just risk value.

4. Regulatory obligations

Depending on the business and the incident, reporting duties may be triggered — to a supervisory authority, to affected individuals and in some cases to partners. Reporting has deadlines (under NIS2, for example, 24 hours for an early warning and 72 hours for a notification) and requires you to be able to describe what happened. If you cannot, the investigation becomes both longer and more expensive.

Add legal support, communications work and any sanctions or compensation claims.

5. What rarely gets counted

• Management time. Weeks of focus that would have gone into business development.
• Staff time. The same people who must keep the business running must also handle the incident.
• Insurance terms. Policies rarely cover everything, and premiums are affected after a claim.
• Deferred projects. Everything else stops.

What actually reduces the cost

No measure makes you invulnerable. But a few things change how an incident unfolds:

1. MFA on administrative accounts and email. Closes the most common way in.
2. Tested backup with a known recovery time. Turns a ransom demand into an annoyance.
3. Inventory of public assets. Means you know what is exposed before someone else tells you.
4. A one-page incident plan. With names, numbers and the first three actions.
5. Logging sufficient to answer “what happened?”. Without it, every investigation costs more.

The perspective that usually settles it

Most companies spend more money dealing with the consequences of an incident than on preventing it. That is not a technical problem — it is a prioritisation. Continuous security is about moving a small, steady cost to the right side of the line instead of paying a large, uneven cost afterwards.

Start by calculating one day of downtime. The number tends to make the rest of the discussion quite simple.