The numbers, with their sources
Ransomware locks your files until you pay. Here is what two Verizon studies found.
| Finding | Figure | Source |
|---|---|---|
| Small business breaches that involved ransomware | 88% | Verizon DBIR, 2025 |
| Same figure at larger organizations | 39% | Verizon DBIR, 2025 |
| Ransomware victims that did not pay | 64% | Verizon DBIR, 2025 |
| First entry by exploiting a software flaw | 31% | Verizon, 2026 study |
| Median time to fully fix a critical flaw | 43 days | Verizon, 2026 study |
Read the 88% carefully
It describes breaches that already happened. It does not say 88% of small businesses get breached.
It says that when a small business is breached, ransomware is usually part of it.
What a breach can cost a small business
Verizon's 2026 study adds a hard case. In the worst 2.5% of cases, a breach cost more than 7% of a small business's revenue.
That is the worst end of the range, not the middle.
Two numbers to be careful with
You may see IBM's $4.99 million figure quoted. It is a global average from larger organizations. Do not apply it to a small firm.
Sophos found that 56% of attacks in its sample encrypted data. Its sample is organizations that were already hit, so it overstates the base rate.
What helps: backups you have tested
CISA calls backups your best hope of recovery from ransomware, and asks for recovery tests.
Keep copies of your business files, not only the originals.
Keep one copy somewhere a locked office computer cannot reach.
Restore one real file from the backup, open it, and write down the date.
Repeat the restore test on a schedule you set, and keep the dates.
Questions
What percent of small business breaches involve ransomware?
In Verizon's 2025 Data Breach Investigations Report, ransomware appeared in 88% of small business breaches, against 39% at larger organizations. That describes breaches that happened, not the chance of being breached.
Does IBM's $4.99 million breach cost apply to a small business?
No. It is a global average from larger organizations. Verizon's 2026 study found that in the worst 2.5% of cases a breach cost a small business more than 7% of its revenue.
What does CISA say helps a small business recover from ransomware?
CISA calls backups your best hope of recovery from ransomware and asks businesses to test recovery.
Sources
Each source was read for the book on 2026-09-29. Recheck before you rely on it.
- Verizon, 2025 Data Breach Investigations Report snapshot, 2025. verizon.com
- Verizon, 2026 DBIR and Breach Impact Study, small business infographic, 2026. verizon.com
- IBM, Cost of a Data Breach Report 2026, 2026. ibm.com
- Sophos, State of Ransomware 2026 (search snippet), 2026. sophos.com
- CISA, Back Up Business Data, read 2026-09-29. cisa.gov
What to do next
MeshVault sets up a server you own, pairs Hermes Desktop to it, and keeps a backup that we have tested. The one-week install is $1,500 as of 2026-09-29. Requote before use.