How much does a data breach really cost?
“We are too small to interest hackers.” This is the most dangerous sentence in cybersecurity. Attacks are largely automated: they target weaknesses, regardless of your brand. For an SME, a data breach can threaten the company's very survival.
Key figures
IBM's annual “Cost of a Data Breach” study is a reference on the subject:
In France, the average cost of a breach also runs into millions of euros. Of course, not every breach costs that much — but even a fraction of these amounts can put an SME in serious difficulty.
Where do the costs come from?
- Business interruption : systems offline, orders blocked and teams focused on the crisis.
- Incident response : investigation, recovery and support from specialist providers.
- GDPR obligations : notifying the CNIL within 72 hours, informing affected individuals and possible penalties.
- Reputation : lost customers and contracts — clients increasingly demand security assurances.
- Long-term impact : some costs continue for years after the incident.
The number one factor: stolen credentials
Phishing and credential theft are involved in the majority of breaches. In practice: an employee's password leaks in a breach of a third-party service, it is reused on your VPN or email system, and the attacker walks in through the front door, without a sophisticated exploit.
Why early detection makes all the difference
Taking nearly 200 days to discover a breach gives an attacker 200 days to explore, exfiltrate and prepare. Every week saved on detection directly reduces the cost: organisations that detect and contain incidents quickly pay significantly less. For an SME without a SOC or dedicated team, automated monitoring of exposure and data leaks is the most accessible way to achieve this.
SME checklist
- Enable multi-factor authentication (MFA) everywhere, starting with email and VPN access.
- Monitor whether your domains appear in data leaks or breaches.
- Inventory what you expose on the Internet and close unnecessary services.
- Prepare your CNIL notification procedure before you need it.
Sources: IBM “Cost of a Data Breach Report” (ibm.com) · CNIL, personal data breaches (cnil.fr). Figures are rounded and provided as an indication of scale.