It's a Tuesday morning, and your inbox looks normal. An invoice from a vendor you recognize. A password reset you didn't request, but you barely notice. A calendar invite from someone on your team. Nothing about the day suggests it's the one where things go wrong. Then your systems slow down. Then they stop. By the time your IT provider calls you back, you already know this is not a routine outage.

That scenario plays out for a small or midsize business somewhere in the country every day, and the bill for it just hit a record high. The average data breach now costs businesses $4.99 million globally, a 12% jump from last year, and small and midsize businesses remain the most frequent target. Here is what drives that number, why it hits smaller companies hardest, and what to do about it before your business becomes part of next year's statistics.

What the cost of a breach includes

A ransom demand is only one line item. The real cost of a breach includes detection and investigation, business lost while systems are down, customers who leave because they no longer trust you, legal and regulatory exposure, and months of cleanup afterward. According to IBM's 2026 breach cost report, rising detection, escalation, and lost business costs are the biggest drivers behind this year's record-high average.

Small and midsize businesses are the primary target

Attackers are not primarily going after Fortune 500 companies. Verizon's 2026 DBIR findings show that small organizations accounted for 96% of ransomware victims this year, and ransomware was involved in 48% of all confirmed breaches, up from 44% the year before. Attackers go where the defenses are thinnest and the payout is still worthwhile, and that is most often a business with a few hundred employees or fewer and no dedicated security team.

AI is raising the stakes

One in four malicious breaches this year were AI-enabled, a 56% increase over last year, and those breaches cost an average of $1 million more than the typical incident. Attackers are using AI to write more convincing phishing emails, clone voices for fraud calls, and scan for vulnerable systems faster than most IT teams can patch them. Capabilities that once required a skilled attacker are now available to almost anyone, so both the volume and the sophistication of attacks aimed at your business are climbing together.

Thinking you're too small to be a target is costly

Larger enterprises can usually absorb a breach and keep operating. Most small and midsize businesses cannot. Recovery costs, downtime, and lost customer trust hit a smaller operation much harder, and many businesses that suffer a serious breach never fully recover their previous revenue or reputation. Assuming you are too small to be worth targeting is exactly the assumption attackers are counting on.

What this means for your business

Breach costs are rising, AI is accelerating attacks, and small and midsize businesses are the most targeted group, not the least. Closing the basics now, MFA, backups, patching, and trained employees, is the difference between a close call and a costly one.

→ Watch Cybersecurity Challenges Keeping Leaders Awake

Join us September 16 to close these holes

Info Advantage is walking through exactly this on September 16 in Think Before the Breach: Building a Cyber-Aware Workplace, a live session with a Sophos cybersecurity expert and our own Nick Wetherwax. You will leave with a clear picture of where you stand on multi-factor authentication, employee awareness training, patching, and backups, the handful of things that stop most attacks before they start.

Register for the September 16 webinar to save your seat.

FAQ: The Cost of a Cyberattack

What counts as a "cost" in a data breach?

Detection and investigation, incident response, downtime and lost business, customer notification, legal and regulatory penalties, and long-term reputational damage all factor in. Ransom payments, when they happen, are often the smallest piece.

Why are small and midsize businesses targeted more than large enterprises?

Attackers look for the combination of valuable data and weak defenses. SMBs frequently have both, along with limited IT staff and fewer resources to recover quickly, which makes them efficient, repeatable targets.

How is AI changing the threat landscape?

AI lets attackers write more convincing phishing messages, impersonate voices and faces, and scan for vulnerabilities at a speed manual attackers never could. It has lowered the skill required to launch a damaging attack.

Can a small business really recover from a breach?

Some do, but many do not fully recover lost revenue, customers, or reputation. Recovery odds improve significantly for businesses that had backups, an incident response plan, and cyber insurance in place before the incident.

What can I do right now to lower my risk?

Start with multi-factor authentication on every account, confirm your backups restore, and make sure your team knows how to spot and report a suspicious message. Those three steps close the door on most common attacks. Ready to see where your business stands?

Talk to Info Advantage about a readiness consultation.