81% of Small Businesses Were Breached Last Year

The numbers are in, and they are brutal

Four out of five small businesses were hit by a security breach, a data breach, or both in the past 12 months. That is the headline finding from the Identity Theft Resource Center’s 2025 Business Impact Report, which surveyed 662 small business owners and executives. And the driving force behind the surge is not some obscure new exploit — it is artificial intelligence.

AI-powered attacks were identified as the root cause in more than 40% of those cyber events. Phishing emails now use AI language models in 82.6% of cases, achieving a 60% success rate against humans — nearly four times higher than traditional phishing campaigns. Ransomware groups are using AI for reconnaissance, vulnerability scanning, and even ransom negotiations, all without human oversight.

For small businesses in Appalachia and beyond, this is not a distant enterprise problem. It is happening right now, to businesses your size.

Why AI-powered attacks hit small businesses hardest

Large companies have dedicated security operations centers, threat intelligence teams, and seven-figure cybersecurity budgets. Small businesses have the owner’s nephew who is “good with computers.” That gap has always existed, but AI is making it catastrophic.

Here is why. AI dramatically lowers the barrier to entry for cybercriminals. A single operator with the right AI tools can now launch personalized phishing campaigns against hundreds of businesses simultaneously. Malwarebytes reported that cybercrime “began its shift toward an AI-driven future” in 2025, and projects that fully autonomous ransomware pipelines will mature in 2026.

The ITRC data confirms this on the ground:

• 81% of small businesses suffered a breach in the past year
• AI-powered attacks caused over 40% of those incidents
• Nearly 40% of breached businesses raised prices to cover the costs
• 84% of business owners say they self-manage their cybersecurity
• 28% admit the person managing their security lacks sufficient training

That last stat is the quiet crisis. Most small businesses do not have a cybersecurity strategy — they have a hope-nothing-happens strategy.

The financial reality

The consequences are not abstract. Recovering from a ransomware attack costs an average of $1.53 million, excluding ransom payments. For small businesses, that number is existential. Roughly 60% of small businesses that suffer a cyberattack close within six months.

Meanwhile, IBM’s 2026 X-Force Threat Intelligence Index found a 44% increase in attacks exploiting public-facing applications, driven by AI-enabled vulnerability discovery. And a 49% increase in active ransomware groups compared to the prior year.

The attackers are scaling. Small business defenses are not.

Zero Trust on a small business budget

You have probably heard the term Zero Trust floating around cybersecurity conversations. The concept is straightforward: never trust any user, device, or connection by default. Verify everything, every time.

That used to require enterprise-grade infrastructure and a six-figure budget. Not anymore. Cloud-native Zero Trust solutions have made the approach accessible to businesses with five employees or 50.

Here are practical options that small businesses can actually afford:

Identity and access management:

• JumpCloud — Unified identity, device, and access management. Built specifically for small and mid-sized businesses. Includes MFA, conditional access, and device management.
• Cloudflare One — Scalable Zero Trust access with global reach. If you already use Cloudflare for your website, adding Zero Trust access is a natural extension.

Network security:

• Twingate — Zero Trust network access that deploys in about 15 minutes without altering your existing network. A practical VPN replacement.
• NordLayer — Designed for remote and hybrid workforces. Least-privilege access with continuous monitoring.

The ROI case: Organizations that adopt Zero Trust reduce breach costs by 38% on average, according to IBM. That is not a marginal improvement — it is the difference between surviving a breach and closing your doors.

Five steps to protect your business this week

You do not need a six-month security overhaul. Start with these five actions that deliver immediate protection:

1. Turn on multi-factor authentication everywhere

MFA is the single highest-impact security measure you can take. Enable it on every cloud service, email account, and remote access tool your business uses. This blocks the vast majority of credential-stuffing attacks, even if a password is compromised.

2. Audit who has access to what

List every tool, account, and system your business uses. Check who has access to each one. Remove access for former employees, contractors, and vendors who no longer need it. Least-privilege access is the foundation of Zero Trust, and it costs nothing to implement.

3. Set up AI-powered email filtering

AI phishing attacks require AI defenses. Modern email security tools from providers like Microsoft 365, Google Workspace, and Barracuda use machine learning to detect AI-generated phishing in ways rule-based filters cannot. If you are still relying on basic spam filtering, you are bringing a knife to a gunfight.

4. Back up your data with the 3-2-1 rule

Keep three copies of your data on two different types of media, with one copy stored offsite or in the cloud. Ransomware only works if losing your data is your only option. Automated backups to a cloud provider cost as little as $10 per month and can save your business.

5. Train your team (even if it is just you)

The ITRC found that 28% of small businesses admit their cybersecurity person lacks training. You do not need a certification — you need awareness. Services like KnowBe4 offer security awareness training starting at a few dollars per user per month. Teach your team to spot AI-generated phishing, verify unexpected requests, and report suspicious activity.

Our take

The 81% breach rate is alarming, but it is not surprising. Small businesses have been the low-hanging fruit for cybercriminals for years. What changed is the tool. AI gives attackers the ability to operate at enterprise scale against small business targets.

The good news: AI also gives defenders a massive advantage. Organizations that extensively deployed AI and automation in their security operations cut breach response time by 80 days and saved $1.9 million on average per incident. The businesses that will survive this era are the ones that use AI on both sides of the equation — defending against AI-powered attacks with AI-powered defenses.

The bottom line: Cybersecurity is no longer optional for small businesses. It is as essential as locking your front door.

If you read our recent coverage of agentic AI as the top cyber threat for 2026, you know the threat landscape is accelerating. This ITRC data puts hard numbers behind what security professionals have been warning about.

The businesses that act now — starting with MFA, access audits, and basic Zero Trust principles — will be the 19% that do not appear in next year’s breach statistics.

Need help evaluating your security posture or implementing AI-powered defenses? Talk to our consulting team — we help small businesses build security strategies that match their budget and risk profile.