What to Do When (Not If) Your Small Business Has a Data Breach

Hour 0 to 2: stop the bleeding

The first sign is usually not a ransom note. It is a customer calling to ask whether you sent an email you did not send, or a charge on the card you keep on file, or your own site behaving in a way you have never seen before. An owner on r/smallbusiness put the starting position plainly: "most people ignore security until their site gets hacked and they start losing money." If that is where you are now, skip the guilt and move fast.

Disconnect the affected machine from the network. Do not wipe it; a wiped drive is a destroyed crime scene. Then change the passwords for your email, your bank, and your payment processor from a clean device, not from the infected one. If this is also the day you discover nobody turned on two-factor, the password security post has the 30-minute version of that conversation.

Hours 2 to 8: figure out what left the building

Before you call anyone, write down what was on that machine or account. Customer names? Credit card numbers? Social Security numbers? The answer decides everything that comes next, because the law treats a leaked customer list very differently from a leaked list of customer SSNs.

The cost of guessing wrong is not theoretical. BigID's review of the breach data puts the cost of a small-business breach between $120,000 and $1.24 million, and Proton's breach analysis found 352 million records leaking from small businesses in a single year, per BigID's cost comparison and Forbes' coverage of the Proton analysis. That range is wide because "small business" covers everything from a three-person shop to a 200-seat company. Your number lives in the inventory you are writing down right now.

Timestamp everything. "Customer called at 10:40. Disconnected the office PC at 10:55. Changed bank password at 11:20." This log becomes the backbone of every conversation you have next: with your bank, your lawyer, and possibly your state attorney general.

The notification clock is already running

Most states require notifying affected individuals within 30 to 72 hours, with extra federal deadlines if you handle health or financial data, per Bellator Cyber's 2026 response guide. That is not much time, and the clock starts at discovery, not when you feel ready.

The FTC publishes a full data breach response guide for businesses covering exactly this sequence: secure your systems, fix the vulnerabilities, then notify the right people in the right order, the FTC's Data Breach Response guide. It is written for non-lawyers and it is free. Open it before you call anyone else, because your first calls should be to your bank and a local attorney, not to your customers.

Week one: the mistakes that double the bill

Paying a ransom is the expensive reflex. One 2025 report found ransomware and extortion cost small businesses a median of $46,000, with more than half of victims paying more than $100,000 (see Sources below). Paying rarely recovers the data, and it marks you as a payer for the next round. Get a second opinion from an incident-response firm before you send money anywhere.

The other mistake is rebuilding in a panic and destroying the evidence your insurer or attorney needs. Keep the logs, keep the affected drive, keep the timeline. The week after a breach is paperwork, not heroics.

The one-page plan you write this week

The part you can do before anything goes wrong fits on one page. Write down: who calls the bank (name and cell number), who can pull your backups, your attorney's number, your payment processor's fraud line, and where your customer data actually lives. Tape it inside a cabinet. When the phone rings at 10:40 on a Tuesday, the question is whether the first number on that list is already on your phone. And if you are wondering whether your backups would even hold up under this plan, run the 10-minute backup test before you need it.

Sources

• BigID: Impactful Big or Small, a cost comparison of data breaches ($120,000 to $1.24M range, citing Verizon's 2024 DBIR)
• Forbes: Small Business Hit Hard and Often, 352 million records breached (Proton breach analysis)
• FTC: Data Breach Response, a guide for business
• Bellator Cyber: Small Business Data Breach Response Plan Guide for 2026 (30-72 hour notification deadlines)
• SmartFinancial: 2025 Cyber Attack Report (median $46,000 ransomware/extortion cost)