The typical small or midsize business that files a cyber insurance claim after a data breach absorbs a median loss of $38,406, according to Verizon Business and CyberAcuView's 2026 Breach Impact Study, published in June 2026 from an analysis of 69,683 US cyber insurance claims. For the unluckiest 2.5% of small businesses, losses ran past 7% of annual revenue, a tail risk far steeper than what larger companies face from the same kind of incident.
What is the median cost of a data breach for a small business?
$38,406 is the median insurable loss for a small or midsize business (SMB) filing a cyber insurance claim, per the 2026 Breach Impact Study's revenue-bracket analysis of 24,873 claims. The study defines SMBs as companies with under $25 million in annual revenue, mid-market as $25 million to $250 million, and large enterprises as anything above $250 million.
Company size changes the bill by a wide margin. The mid-market median of $96,448 is roughly two and a half times the SMB figure, and the large enterprise median of $282,759 runs more than seven times higher, matching the study's own framing that the amount "almost triples" moving into mid-market and grows "seven times higher" at the large-enterprise tier.
Figure 1: Median insurable loss per claim by company revenue bracket. Source: Verizon Business/CyberAcuView, 2026 Breach Impact Study, n=24,873 claims.
Takeaway: a small business's typical breach bill is a fraction of a large enterprise's, but "typical" hides a distribution that gets much more dangerous the further out you look.
How much worse can it get in the worst cases?
Small businesses face a disproportionate tail risk: in the worst 2.5% of SMB claims, the insurable loss exceeded $1,001,547, and that amount ran higher than 7% of the company's own annual revenue, according to the same study. Large enterprises and mid-market firms never crossed 2% of revenue even in their own top 2.5% of cases.
That gap is the study's central finding about small business risk. A large company's worst-case breach is a rounding error against its revenue base; a small company's worst-case breach can wipe out most of a year's profit margin. CyberAcuView's CEO, writing in the report's appendix, put it plainly: SMBs "face a disproportionate cyber risk burden, losses that can reach 7% of annual revenue in extreme cases," while typically having fewer resources to invest in defenses.
| Company size | Median breach cost | Top 2.5% of cases | Top 2.5% as share of revenue |
|---|---|---|---|
| Small business (under $25M revenue) | $38,406 | over $1,001,547 | over 7% |
| Mid-market ($25M-$250M revenue) | $96,448 | over $2,016,028 | under 2% |
| Large enterprise (over $250M revenue) | $282,759 | over $22,291,688 | under 2% |
Source: Verizon Business/CyberAcuView, 2026 Breach Impact Study.
Takeaway: insurance planning built around the median case will badly underestimate what a bad year actually costs a small business, since the tail is proportionally steeper the smaller the company gets.
Which incident type costs small businesses the most?
Ransomware drives the SMB numbers more than any other incident type. It showed up in 39% of SMB claims but accounted for 64% of total dollar losses in the segment, a share more than one and a half times its claim frequency, according to the 2026 Breach Impact Study's SMB industry breakdown (15,431 claims, 11,996 with recorded losses).
Figure 2: Incident type mix across SMB claims. Source: Verizon Business/CyberAcuView, 2026 Breach Impact Study, n=15,431 SMB claims.
Business Email Compromise (BEC), where an attacker impersonates a vendor or executive to redirect a payment, was less frequent but still meaningful: 19% of SMB claims with a median cost of $37,982, close to the overall SMB median cost. "Other" incident types, a broader bucket covering everything outside ransomware, BEC, and supply chain events, made up 41% of claims but only 26% of total losses, with a lower median of $31,490 per claim.
Figure 3: How a ransomware payment decision reshapes where the cost lands. Source: Verizon Business/CyberAcuView, 2026 Data Breach Investigations Report and Breach Impact Study.
That payment split is not an SMB-specific finding; it comes from the full claims dataset behind both the 2026 DBIR and the Breach Impact Study, which notes that only 31% of ransomware cases actually resulted in a payment to the threat actor, consistent with the 2026 DBIR's separate finding that 69% of ransomware victims did not pay, a share that has been growing since at least 2022.
For context on how small businesses handle privacy obligations more broadly, not just breach response, see our small business privacy roundup.
Takeaway: ransomware is the single incident type most worth budgeting for, since it converts a below-median claim frequency into a majority of total dollar losses.
How does cost per claim change by incident type?
Median cost per SMB claim tracks the same ranking as total loss share: ransomware highest at $53,381, BEC in the middle at $37,982, and other incident types lowest at $31,490, per the 2026 Breach Impact Study's SMB breakdown.
Figure 4: Median SMB claim cost by incident type. Source: Verizon Business/CyberAcuView, 2026 Breach Impact Study, n=15,431 SMB claims.
The gap between ransomware's median ($53,381) and the overall SMB median ($38,406 from the revenue-bracket cut, or $37,421 from this industry-classified cut) is meaningful but not enormous on its own. What makes ransomware disproportionately expensive is the combination of a high median with a much heavier tail: ransomware claims are far more likely than other incident types to land in the extreme-loss bracket that pushes a business toward that 7%-of-revenue threshold described earlier.
Takeaway: a below-average claim frequency is not the same as a below-average budget risk when the incident type in question has a fatter tail.
How are small businesses insuring against this risk?
Most SMB cyber insurance sits in the simplest coverage layer: 88.9% of SMB claims came from a primary policy, 9.7% from an endorsement added to a broader policy, and only 1.5% from an excess layer stacked on top, according to the 2026 Breach Impact Study.
Figure 5: SMB cyber insurance claims by policy type. Source: Verizon Business/CyberAcuView, 2026 Breach Impact Study, n=15,431 SMB claims.
That concentration in primary policies matters for coverage adequacy: a primary-only policy caps out at its own limit, and the study's authors note that when a claim's total incurred loss matches the policy limit exactly, the real economic loss was likely higher than what the dataset captured. For a small business, a thin coverage tower combined with a fat-tailed incident type like ransomware is a real gap, not a hypothetical one.
A clear, current privacy policy will not prevent a breach, but it does set the baseline for what a small business has already committed to disclose if one happens. A privacy policy generator built for small business compliance needs keeps breach-notification language aligned with what regulators expect, so an already-costly incident does not also trigger a separate notice failure.
Takeaway: most small businesses are insured at the entry level, which is a reasonable starting point for the median case but leaves real exposure against the kind of extreme-tail loss ransomware specifically produces.
The Bottom Line
A $38,406 median cost sounds manageable, and for most small businesses filing a claim, it is. What the 2026 Breach Impact Study makes clear is that the danger is not the median case; it is the 2.5% of small businesses whose breach eats into more than 7% of a year's revenue, a proportional hit that large companies simply do not face at the same rate. Ransomware is the incident type most responsible for that tail, converting a below-average claim frequency into the majority of total dollar losses in the SMB segment. Two related angles this cluster has not yet published stand-alone posts on, the average cost per stolen record and what data breach settlements pay affected individuals, are worth watching for once they go live; for now, the fuller picture across all company sizes is in our companion piece on the cost of a data breach by country and sector and the broader data breach statistics roundup. The practical takeaway for any small business owner: budget for the median, but insure for the tail, since the tail is where small companies get hit hardest.
Frequently Asked Questions
What is the median cost of a data breach for a small business? $38,406, according to Verizon Business and CyberAcuView's 2026 Breach Impact Study, based on 24,873 US cyber insurance claims segmented by company revenue, where small and midsize businesses (SMBs) are defined as those with under $25 million in annual revenue.
How much worse can a data breach get for a small business? In the worst 2.5% of SMB cases, losses topped $1,001,547, and the financial impact ran higher than 7% of the company's annual revenue, versus under 2% of revenue for large enterprises facing their own worst 2.5% of cases, per the 2026 Breach Impact Study.
Which type of incident costs small businesses the most? Ransomware. It accounted for 39% of SMB cyber insurance claims but 64% of total dollar losses in the segment, with a median cost of $53,381 per claim, according to the 2026 Breach Impact Study.
Does the FBI track small business data breach losses too? Not broken out by business size, but the FBI's IC3 logged 3,204 complaints under its dedicated Data Breach crime category in 2024, totaling $364,855,818 in reported losses, an average of roughly $113,900 per complaint, as part of a record $16.6 billion in total cybercrime losses reported that year.
Where the Numbers Come From
- Verizon Business and CyberAcuView. (2026). "2026 Breach Impact Study." Published June 16, 2026. Analysis of 69,683 US cyber insurance claims for incidents from January 1, 2019 through October 31, 2025 (38,181 with recorded, paid-out losses); source for the SMB median cost ($38,406), the top 2.5% revenue-share figures, the incident-type breakdown, and the policy-type breakdown. CyberAcuView is an insurance-industry data consortium and Verizon Business sells managed security services, both with a commercial stake in cyber risk; the study discloses its full sample size and methodology, and this post names both figures alongside the underlying claim counts for that reason.
- Verizon Business. (2026). "2026 Data Breach Investigations Report (DBIR)." Companion report analyzing more than 22,000 breaches across 145 countries; source for the ransomware non-payment trend (69% of victims did not pay) referenced in the incident-type section.
- Verizon Business. (2026). "2026 SMB Infographic." Summary companion to the two reports above, confirming the greater than 7% of revenue figure for extreme-case SMB losses.
- Federal Bureau of Investigation, Internet Crime Complaint Center (IC3). (2025). "2024 Internet Crime Report." Independent government data source, not segmented by business size: $16.6 billion in total reported cybercrime losses in 2024, with 3,204 complaints logged under the dedicated Data Breach category totaling $364,855,818 in losses.
Note: All figures verified as of July 2026. The Breach Impact Study is CyberAcuView and Verizon Business's first edition; the underlying claims dataset spans incidents from 2019 through October 2025 even though the report itself published in June 2026, and figures in this post will be refreshed when a second edition is released.
