Black Hat , Breach , Data Security Most small businesses survive data breaches. Here’s how to make sure yours does too August 5, 2026 Share By Paul Wagenseil Credit: Adobe Stock Images LAS VEGAS — No, 60% of small businesses don't fail within six months of suffering a data breach. That widely circulated figure has been bouncing around for 15 years, but it's dead wrong, security researcher Adrian Sanabria said Tuesday (Aug. 4) at the BSides Las Vegas hacker conference. Sanabria, who hosts many SC Media webinars, wouldn't say who first came up with that figure, but he added that anyone can find out with a little effort. As for how the percentage was derived, Sanabria was blunt: "They made it up." Yet the myth persists. Sanabria says he's recently seen the failure rate stated as 94% of SMBs following data breaches . "Stats like this are irresistible to marketing people," he said. "But bad statistics waste resources. The 60% statistic doesn't tell you where to invest your resources to protect assets." The truth is that most small and medium-sized businesses (SMBs) do survive cyberattacks. Those that don't mostly fail because of a loss of trust or a lack of cash. And those risks can be mitigated, both before and after a breach happens. The numbers don't lie Sanabria said there are an estimated six million small businesses with one or more non-proprietor employees in the U.S. And there were 22,624 confirmed data breaches worldwide from November 2024 through October 2025, according to the 2026 Verizon Data Breach Investigations Report (DBIR). Of those breaches, 7,152 involved SMBs. If 60% of those were to fail, 4,291 SMBs should have gone under worldwide because of cybersecurity incidents from late 2024 through April 2026. Sanabria searched for reports of those company failures. "What I found is that 35 companies worldwide have gone out of business due to a breach — since 2001," he said. "We're looking at a claim of 4,000 per year vs. a verified 35 in the past 25 years." He didn't count companies that would have closed regardless of a data breach, or those that went into Chapter 11 and then recovered. (Sanabria has posted the full list at DestroyedByBreach.com .) It is true, Sanabria said, that SMBs are more likely to fail after a data breach than large enterprises are. It's hard to quantify exactly how likely because no company with more than 1,000 employees has ever gone out of business that way. The largest that did was a regional British logistics and trucking company, Knights of Old, aka KNP Logistics, that had about 750 employees. Ransomware did change the game around 2018, he said. Before then, all companies killed by data breaches had fewer than 100 employees. But following a peak around 2019, the rate of company-killing breaches, especially for medium-sized firms, has trailed off. Survival factors So why did these 35 companies die, Sanabria wondered. Was it size? Cash flow? Is it because larger companies have more cash reserves? All of the above, it turned out, but that wasn't the only factor. "None of the killed companies had 1,000 employees or $100 million in revenue," he said. "Most had fewer than 10 employees. Most closed within 2 weeks of the breach." Knights of Old, for example, had been around for more than 150 years. According to the BBC , ransomware actors broke into the company's network in 2023 by guessing an employee's password. The company just couldn't afford to pay the ransom. Sanabria pointed out that the company had already been struggling. It wasn't growing and didn't have a lot of cash reserves. "Being down for a couple of days hurt them badly enough to put them out of business," he said. "They also couldn't recover the accounting files, which made it hard to sell the company." Knights of Old did have a million-pound cyber-insurance policy — which paid out 8 months after company went out of business. "Insurance will not help you with your cash flow," Sanabria pointed out. Bad reputation Aside from running out of money, the most common reason for an SMB's failure following a data breach was loss of reputational trust, either on the part of customers or of regulators. Sanabria noted that one company killed by ransomware was a small managed service provider (MSP) in Oregon that serviced dental practices. When the MSP got hit by ransomware in 2019, the encryption spread to its clients as well. The MSP couldn't handle the recovery job and chose to shut down instead, leaving its clients out in the cold. Another case involved a medical-transcription service that, because of a configuration error on an FTP server, ended up exposing plaintext patient files so transparently that Google search spiders indexed them in 2016. As a result, a client that was 40% of the company's business canceled its contract, the company settled a lawsuit for $200,000 and shut down, and the owner was banned from ever again managing or owning a business in New Jersey. Notably, there was no actual malicious activity. But because of strict regulations covering medical records, even accidental leaks of patient data are "almost guaranteed to kill the company," Sanabria said. A perfect example of that was American Medical Collection Agency , which in 2019 found that millions of its files containing sensitive patient records and payment-card information had been posted online. The legal fallout was so extensive that not only did AMCA close within four months, but one of its biggest clients, LabCorp, ended up settling several class-action lawsuits even though LabCorp itself had not been breached. Data recovery by itself can't restore trust, Sanabria said. Most of the companies on his list were able to recover their systems, yet they still went out of business. But again, it's the little guys who suffer the most from damage to reputation. Household-name companies like LinkedIn, Yahoo and Equifax have suffered huge data breaches as the result of malicious intrusions, but they're still around. In the UK, a spate of huge data breaches and ransomware attacks in the past year have hit the automaker Jaguar Land Rover , the venerable retailer Marks & Spencer , and the Co-op supermarket chain, yet these companies turned out to be too big to fail. The Jaguar Land Rover incident stopped production for weeks and affected Britain's GDP. But Sanabria said some 4,000 other businesses were found to be dependent on JLR, and its failure would have caused even more damage. How to contain the damage Sanabria didn't have any suggestions for companies that are short of cash when an attack or breach happens, other than to have a line of credit at the ready. But he pointed out that transparency and honesty go a long way toward restoring trust after a breach. Especially in healthcare, he said, "the more transparent you are, the less you'll get sued for." An audience member cited CrowdStrike as handling its devastating July 2024 bad-update incident very well, with the company leader's same-day online mea culpa and subsequent apology tour to visit affected clients. Unfortunately, Sanabria said, many companies of every size still think it's wiser to not disclose data breaches. That's mainly out of fear of legal exposure, even though it's clear that timely and full disclosure is the better policy. "Most of the reasons we have for keeping breaches quiet are not good reasons," Sanabria said. "The model is there, and we know how to do it, but the lawyers won't let us." Paul Wagenseil Paul Wagenseil is a custom content strategist for CyberRisk Alliance, leading creation of content developed from CRA research and aligned to the most critical topics of interest for the cybersecurity community. He previously held editor roles focused on the security market at Tom’s Guide, Laptop Magazine, TechNewsDaily.com and SecurityNewsDaily.com. Related Black Hat Black Hat 2026: 6 qualities security pros should look for in agentic AI systems Morey J. Haber August 4, 2026 Teams need to implement agentic AI with and open mind – and a closed security model. Cloud Security Black Hat 2025 Insights: Reflections on the Salesforce hacks and our industry’s future Amir Khayat August 12, 2025 Former New York Times cyber reporter Nicole Perlroth asks Black Hat attendees an important question: The adversaries work together, so why don’t we? AI/ML Black Hat: Sloppy AI defenses take cybersecurity back to the 1990s, researchers say Paul Wagenseil August 11, 2025 The startling lack of good security practices around AI has cybersecurity veterans wondering which decade we're living in. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Attack Vector Byte Checksum Cipher Ciphertext Cyclic Redundancy Check (CRC) Data Aggregation Data Encryption Standard (DES) Data Loss Prevention (DLP) Data Warehousing You can skip this ad in 5 seconds