How Much Does a Ransomware Attack Cost a Small Business?

A ransomware attack costs the median victim $115,000 in ransom alone, according to Verizon's 2025 Data Breach Investigations Report — and the ransom is usually the smaller line item. Sophos' State of Ransomware 2025 found the average cost to recover from an attack, excluding any ransom payment, was $1.53 million across all company sizes. For a small business, the realistic total depends on how long you're down and whether data was stolen, but the bill always has the same four parts: downtime, recovery, the ransom decision, and notification and legal costs.

The headline numbers understate the small-business reality, not overstate it. The FBI's Internet Crime Complaint Center logged $16.6 billion in total reported cybercrime losses in its 2024 annual report, with ransomware complaints up 9% year over year — and the report is explicit that its ransomware loss figures exclude lost business, time, wages, files, and equipment. Those uncounted categories are exactly where a 20-person company bleeds.

Below, we break the bill into its four components, then translate the research numbers into what they'd actually mean for a Lake Charles-sized firm.

---

Why Small Businesses Take the Harder Hit

It's tempting to assume ransomware crews only chase hospitals and Fortune 500 logos. The data says the opposite. Verizon's 2025 DBIR found ransomware present in 88% of breaches at small and mid-sized businesses, versus 39% at large organizations. Attackers automate their targeting, and small companies are the path of least resistance: no dedicated security staff, remote access that hasn't been hardened, backups that have never been test-restored, and one shared password away from the accounting system.

The asymmetry is what makes it dangerous. A large enterprise can absorb a bad week; a small firm runs on this month's receivables. That profile fits a lot of Southwest Louisiana — contractors, medical and dental clinics, law offices, distributors, and plant-services companies around Lake Charles running lean, often with no in-house IT at all. If you want the prevention side first, start with our small business cybersecurity checklist; the rest of this post is about the invoice you get when those controls aren't there.

Where the Money Goes: The Four Costs

Every ransomware bill decomposes into the same four buckets. Here's what each one covers and what the current research says about it:

There's a fifth cost that never shows up on the incident invoice: what happens afterward. Cyber insurance premiums typically get reassessed after a claim, customers and vendors ask harder questions, and any contract that required you to safeguard their data is now a conversation. None of that is a line item, and all of it is real money.

The 20-Person Lake Charles Firm: A Worked Example

National averages are abstract, so let's make it concrete. The figures below are an illustration with stated assumptions — not survey data — so you can swap in your own numbers.

Add it up: in this illustration, the first week is already roughly $72,000 in payroll and revenue exposure before a single recovery invoice or legal bill arrives — and Verizon's median ransom payment of $115,000 sits on top of all of it if you choose to pay. A ransomware attack doesn't need to look like the national headlines to be the worst financial event in a small company's history.

Southwest Louisiana businesses already understand downtime better than most — we plan for it every hurricane season. Ransomware is the same business-continuity math with no forecast track and no five-day cone. The disciplines overlap almost completely, which is why our hurricane IT preparedness checklist for SWLA reads a lot like a ransomware readiness plan: know what systems matter, know where the backups are, and know who does what when things go dark.

What Actually Shrinks the Number

You can't negotiate the averages, but you can decide which side of them you land on. Five controls move the cost curve more than anything else:

Tested, offline backups. The single biggest lever. A backup the attacker can't reach — offline or immutable — and that you've proven you can restore turns "pay or die" into "restore and rebuild." Be honest about the limit, though: backups don't undo data theft, so extortion threats and notification duties can survive even a perfect restore.

Multi-factor authentication everywhere. Stolen credentials remain one of the most common ways attackers walk in the front door. MFA on email, remote access, and financial systems closes the cheapest path.

Email security done right. Most small-business attacks start in the inbox. Filtering, sender authentication, and tighter sender controls stop the first click — we walked through one practical control in our post on building an approved-sender whitelist in Microsoft 365.

Endpoint detection and response. Catching an intrusion in hours instead of weeks changes every number in the table above. EDR watches behavior — a process encrypting files in bulk gets isolated, not discovered Monday morning.

A rehearsed incident response plan. The companies that recover fastest aren't lucky; they've decided in advance who to call, what to isolate, and what order to restore in. The plan costs almost nothing. Not having one costs days.

Standing all of this up — and watching it around the clock — is the core of AOP's managed IT and cybersecurity service. We quote it as flat-rate pricing customized to your business, so protection is a predictable monthly number instead of an unpredictable six-figure event.

Frequently Asked Questions