← All Posts
April 12, 2026 Cybersecurity 7 min read

The Real Cost of a Website Breach for Small Businesses

A single breach costs small businesses an average of $120,000. Here is the breakdown and how to prevent it.

The Number Nobody Wants to Hear

IBM's annual Cost of a Data Breach Report tracks what organizations actually spend when their systems are compromised. For small businesses with fewer than 500 employees, the average total cost of a data breach is $120,000. That number includes direct expenses, lost business, and recovery costs.

For context, $120,000 is more than the average annual salary of a small business owner in the United States. It is enough to pay for two full-time employees for a year. It is roughly 2,400 months of Forge Shield monitoring. That last comparison is the one that should stick with you.

Most small business owners assume breaches happen to banks and hospital systems. The reality is that small businesses account for 43% of all cyberattacks, and 60% of those that are breached close their doors within six months. The businesses that survive do so because they had monitoring, backups, and an incident response plan -- or because the breach was caught early enough to contain.

The Direct Costs: What You Pay Out of Pocket

When a breach occurs, the immediate expenses hit fast and hit hard. Here is what the first 30 days typically look like:

Incident Response and Forensics

The first step is figuring out what happened. This requires a cybersecurity firm to analyze your systems, identify the attack vector, determine what data was accessed, and confirm the attacker is no longer inside your network. For a small business website breach, forensic investigation costs typically range from $10,000 to $30,000. If the breach involves a database with customer records, the investigation is more extensive and more expensive.

Legal Fees

You need a lawyer who specializes in data breach response. They advise on notification requirements, regulatory obligations, and liability exposure. Legal fees for breach response typically start at $5,000 and can exceed $50,000 depending on the scope of data exposed and the jurisdictions involved.

Customer Notification

Every US state has breach notification laws. If your customer data was exposed -- names, emails, phone numbers, payment information -- you are legally required to notify affected individuals. Depending on the state, you may also need to provide credit monitoring services. Notification and credit monitoring costs average $150 per affected record. If your contact form stored 500 customer records, that is $75,000 in notification costs alone.

System Remediation

After the forensic investigation identifies the vulnerability, you need to fix it. This may involve rebuilding your website from scratch, migrating to a new hosting platform, implementing security controls that should have been there from the start, and verifying that no backdoors remain. Remediation costs vary widely but typically fall between $5,000 and $25,000 for a small business site.

The Indirect Costs: What You Lose Over Time

The direct costs are painful but finite. The indirect costs compound over months and years, and they are often larger than the initial incident expenses.

Lost Customers

Trust is the foundation of every small business relationship. When customers learn that your website was compromised, many of them leave. A Ponemon Institute study found that 31% of consumers discontinue their relationship with a breached organization. For a service business with 200 active customers and an average lifetime value of $2,000 per customer, losing 31% represents $124,000 in lost future revenue.

This loss is permanent. Those customers are not coming back. They are going to your competitor who was not breached.

Reputation Damage

News of a breach spreads through local communities quickly, especially in service industries. Word of mouth works in both directions. A roofing contractor whose website leaked customer addresses, a dental practice that exposed patient emails, a daycare whose contact form data was stolen -- these stories circulate through neighborhood groups, review sites, and local forums.

The reputation impact is difficult to quantify but easy to observe. New customer inquiries drop. Referrals slow down. The Google reviews start mentioning security concerns. Rebuilding trust takes years of consistent, incident-free operation.

Insurance Premium Increases

If you carry cyber insurance (and you should), a claim will increase your premiums significantly. Many small business cyber insurance policies see 25-40% premium increases after a claim. Some insurers will decline to renew entirely, forcing you to find coverage in a higher-risk market at a higher price.

If you do not carry cyber insurance, the full cost of the breach comes out of your operating budget. For most small businesses, this means taking on debt or depleting reserves that were earmarked for growth.

The Downtime Tax

Every day your website is offline or compromised, you are losing revenue. The National Cyber Security Alliance reports that the average small business takes 21 days to fully recover from a breach. Twenty-one days of no website, no online lead capture, no customer-facing presence.

Calculate your website's daily value. How many leads does it generate per day? What is each lead worth in closed revenue? For a contractor generating five quote requests per day with a 30% close rate and an average job value of $3,000, that is $4,500 in daily pipeline value. Twenty-one days of downtime represents $94,500 in lost pipeline.

Add the cost of emergency workarounds -- answering phones manually that were routed through the website, sending paper invoices because the online system is down, paying for temporary hosting while the primary site is under investigation. These operational disruptions are invisible on a balance sheet but very real in daily operations.

A Hypothetical That Is Not Hypothetical

Consider a general contractor in metro Atlanta. Five employees, $800,000 in annual revenue, a WordPress website built three years ago by a freelancer who is no longer available. The site has a contact form, a project gallery, and customer testimonials. It generates about 40 leads per month.

An automated scanner finds that the site is running WordPress 5.9 with an outdated contact form plugin that has a known SQL injection vulnerability. The attacker exploits it, gains access to the database, and downloads three years of contact form submissions -- names, phone numbers, email addresses, project descriptions, and street addresses of homes where work was performed.

Here is what the next 90 days look like:

Total first-year impact: $112,850.

This is not an extreme scenario. This is a Tuesday.

Regulatory Exposure You May Not Know About

Data breach liability is not limited to federal law. Every US state has its own breach notification statute with specific requirements, timelines, and penalties. Georgia, for example, requires notification to affected residents "in the most expedient time possible" and imposes penalties for failure to notify.

If you collect data from customers in California (even if you are not based there), the California Consumer Privacy Act (CCPA) applies. Penalties for non-compliance can reach $7,500 per intentional violation. If the FTC determines that your security practices were inadequate, they can pursue enforcement action under Section 5 of the FTC Act, which prohibits unfair or deceptive business practices.

The regulatory landscape is expanding, not shrinking. New state privacy laws take effect every year. The cost of compliance after a breach -- retroactive audits, policy drafting, staff training -- adds another layer of expense that most small businesses do not anticipate.

Prevention Is Not Expensive. Breach Recovery Is.

Here is the comparison that matters:

For every dollar you spend on continuous monitoring, you avoid $204 in potential breach costs. This is not a marketing number. It is arithmetic.

Forge Shield provides continuous security scanning that catches the vulnerabilities attackers exploit: missing security headers, outdated software versions, SSL certificate expiration, exposed admin panels, and configuration weaknesses. It runs daily, reports in plain language, and tells you exactly what to fix and how to fix it.

You would not operate your business without general liability insurance. You would not drive without auto insurance. Your website handles customer data, generates leads, and represents your business to every potential customer who searches for you online. Protecting it is not optional.

Forge Shield catches vulnerabilities before attackers do. Start monitoring today and make the $120,000 breach a problem that happens to someone else.

← Back to all posts