Report by Identity Theft Resource Center
ITRC 2025 Business Impact Report
Key Findings
AI-powered attacks were identified as a root cause in more than 40% of small business cyber events.
In 2025, more than 80% of small businesses reported being victims of cybercrime.
In 2025, only 38.4% of small business leaders felt 'very prepared' for a cyberattack, down from 56.5% in 2024.
62.5% of small businesses that suffered a breach reported a total financial impact of more than $250,000 in 2025.
36.7% of victims among breached small businesses faced costs exceeding $500,000.
81% of small businesses reported suffering a security breach, a data breach, or both in the past year.
38.3% of small business leaders reported raising prices to address the financial impacts of a cyber incident.
The implementation of critical security measures among small businesses declined from 33.6% in 2024 to 27.2% in 2025.