ARMONK, September 22 — More than half of U.S. small businesses were hit by at least one cyberattack in the past year, and the companies that went in without a plan are the ones paying the steepest price. The figure comes from iuvo, which puts the share at 56%. That is a majority of small firms — not a fringe risk, not something that only happens to careless companies.
And the consequences of being unprepared are well documented: cyberattacks, data breaches, financial losses, operational downtime and reputational damage, with teams left scrambling to identify the problem, protect affected systems and keep operations moving while costs and risks grow.
Eight months of exposure
IBM’s research found that in 2025, organizations took an average of 241 days to identify and contain a cyber breach. Think of it like a leak in a building you can’t find — nearly eight months of exposure and response activity, with the meter running the whole time. Recovery is often just as slow.
Sophos found that only 53% of ransomware-affected organizations fully recovered within a week. Every organization that had data encrypted in a ransomware attack reported direct repercussions for its IT and cybersecurity team, including increased stress and guilt.
In 25% of cases, leadership was replaced.
What gets stolen
Customer personally identifiable information was the most stolen or compromised data type in 2025, appearing in 53% of breaches, according to IBM. Employee PII showed up in 37% of incidents, and intellectual property in 33%. The risk extends beyond internal systems to information held by vendors, partners or service providers.
The market notices. A 2025 AON analysis found major cyber incidents produced an average 9% decrease in shareholder value in the year following the event.
Of 1,407 cyber events analyzed, 49 developed into reputation risk events, resulting in a 27% decline in shareholder value. The 2025 Hiscox Cyber Readiness Report found malware and ransomware attacks accounted for approximately 60% of reputation risk cyber events, and 29% of SMBs that experienced a cyberattack reported negative publicity as a direct consequence.
Costs, coverage and AI
IBM data cited in the source puts healthcare breaches at an average of $7.42 million per incident and financial services breaches at an average of $5.56 million per incident. Heavily regulated industries including financial services, biotech and life sciences face elevated legal, regulatory and contractual exposure. Cyber insurance can help businesses recover, but it does not replace a strong cybersecurity plan.
Insurers often want to see basic protections already in place before approving or renewing coverage, and missing or undocumented controls can mean fewer policy options or complications when filing a claim. AI is changing how cybercriminals plan and carry out attacks, enabling more convincing phishing messages, faster testing of new tactics, campaigns scaled across more targets, and discovery of previously undetected security gaps.
A cybersecurity plan can help businesses keep pace by updating employee training, response procedures and security tools, including AI-enabled defenses where appropriate. The throughline is simple: a cybersecurity plan is a foundational strategy, not a discretionary add-on. Watch for how small firms respond as AI-driven attacks get cheaper to run.
