The Real Costs of Data Breaches and What We Can Learn

Cybersecurity Awareness Month Series | October 2026

Data breaches do not just affect major corporations, small and medium sized enterprises are some of the most common targets. According to IBM’s 2026 Cost of a Data Breach Report, the average breach now costs $4.99 million worldwide and $11.5 million in the United States, both record highs. Luckily, there are some procedures and steps every small business can take to mitigate this.

Our story this week is on two well studied cases of small businesses that were unfortunate victims of data breaches, and what we can learn from them.

Case 1: An Escrow Firm Loses $1.5 Million and Closes Its Doors

Efficient Services Escrow Group was a profitable escrow company in California. It was on track to clear about half a million dollars in profit for the year.

What happened: In late 2012, attackers infected the company’s computers with a remote access trojan, a type of malware that lets criminals secretly control a machine. Using that access, they logged in to the firm’s online banking and sent three fraudulent wire transfers:

• December 2012: about $432,000 wired to Russia

• January 2013: two more transfers totaling about $1.1 million wired to China
  

The bank recovered the first transfer. The $1.1 million sent to China was never recovered.

The cost: Because escrow firms hold client money, California regulators gave the company three days to replace the missing funds. It couldn’t. The state placed the company in receivership, all nine employees lost their jobs, and the business was forced to close.

As one of the founders put it: “We lost everything.”

The lesson: This wasn’t a sophisticated attack on a large target. One infected computer led straight to the company’s bank account. The firm had no endpoint protection to catch the malware, no way to verify unusual transfers, and nothing in place to block large overseas wires. Together, those gaps wiped out a healthy business in a matter of weeks.

Case 2: A Medical Practice Refuses a $6,500 Ransom and Loses Everything

Brookside ENT and Hearing Center was a two-physician medical practice in Battle Creek, Michigan.

What happened: In early 2019, ransomware encrypted the practice’s entire system, including patient records, appointment schedules and billing information. The attackers demanded $6,500 for the decryption key.

The physicians refused to pay. There was no guarantee the key would work, and paying could have invited more demands. The attackers then deleted every file on the system.

The cost: With no usable copy of their data, the doctors faced rebuilding years of patient records from nothing. They chose to retire early and closed the practice in April 2019. Patients who hadn’t kept copies of their own records lost them as well.

The lesson: The ransom wasn’t what ended this business. The lack of a recoverable backup was. With a secure, offline backup, an attack like this would have caused a few days of disruption, not a permanent closure.

What These Cases Have in Common

Neither business was targeted because it was famous or especially large. They were targeted because they were accessible. Their experience matches what the data shows today: Verizon’s 2025 Data Breach Investigations Report found that small and mid-sized businesses had nearly four times as many confirmed breaches as large organizations, and ransomware was involved in 88% of those small-business breaches.

For a large company, a breach is an expensive event. For a small business, it can be the end.

How to Reduce Your Risk

These are the controls that would have changed the outcome in both cases:

• Endpoint detection and response (EDR): Modern endpoint protection catches malware like remote access trojans before attackers can use them.

• Multi-factor authentication (MFA): Require a second verification step on banking, email and remote access, so stolen credentials alone aren’t enough.

• Payment verification procedures: Set up dual approval and callback confirmation for wire transfers, and ask your bank about alerts and limits for unusual or international payments.

• Backups using the 3-2-1 rule: Keep three copies of your data on two types of storage, with one copy offline or offsite where ransomware can’t reach it. Test restoring from it regularly.

• An incident response plan: Know ahead of time who to call, what to shut down and how to communicate with clients. Make those decisions before an attack, not during one.

• Cyber insurance: Review your coverage. Many policies now require controls like MFA and backups before they’ll pay a claim.
  

Is Your Business Prepared?

Most small businesses that suffer a breach aren’t careless. They just assume it won’t happen to them. These two businesses learned otherwise at the highest possible cost.

At MP Managed Solutions, we are proud to help small and mid-sized businesses in the DMV close these gaps with practical, right-sized security, including managed endpoint protection, backup and disaster recovery, MFA rollout and incident response planning. Call or email us to have a conversation about where your business stands.