What a data breach really costs a small business
23 June 2026, 10:38 am · 2 min read
Small businesses assume they're too small to target. They're not, they're targeted because they're small: fewer defences, real money, real customer data. And most breaches aren't clever. They're a reused password and an account nobody switched off.
The boring stuff that actually protects you
- Individual logins + 2FA. A texted code stops the vast majority of account takeovers.
- Least privilege. People see only what their job needs.
- Off-boarding in one click. When someone leaves, access leaves with them, today, not eventually.
- Encrypted, backed-up, exportable data you actually control.
- An access log so "did anything happen?" has an answer.
The five-minute audit
You can find most of your exposure over a coffee. Walk through these and be honest about the answers:
Who still has keys?
List everyone who can log in. Recognise all of them? Every stranger and every ex-staffer on that list is a door left open.
Is anything shared?
One password five people know is one password nobody can safely change. Shared logins are the classic soft spot.
Where does the data live?
If you can't say where customer records sit and who can reach them, neither can you protect them.
Could you switch someone off now?
Time it. If cutting access takes longer than a coffee, off-boarding is a gap, not a process.
What good off-boarding looks like
The single highest-value habit is the cleanest goodbye. When someone leaves, one action ends every login, reassigns their work, and leaves a record that it happened. No lingering accounts, no "we'll sort it later", no forgotten door six months on. It's unglamorous, and it prevents a genuinely large share of real-world breaches.
Most breaches aren't clever. They're a reused password and an account nobody switched off.
Security is cheaper than the alternative
Building 2FA, roles, audit logs and clean off-boarding into a system costs a little up front. A breach costs you money, weeks, and the trust of every customer whose details leaked. One of those is a line item; the other is a crisis.
If you can't currently answer "who can see our customer data, and could we switch someone off in ten seconds?", that's the place to start.