Most small business owners think a cyberattack is something that happens to big companies. The numbers say otherwise. CERT NZ's 2023 Annual Report recorded over $6.6 million in direct financial losses from cybercrime reported by NZ businesses and individuals — and that's only the cases that were reported. The actual figure is estimated to be five to ten times higher.
For a small business, a breach doesn't need to be large to be catastrophic. Here's what it actually costs.
The direct costs
Incident response — Engaging an IR firm to contain and investigate a breach typically costs $5,000–$50,000 for a small business, depending on complexity. If forensics are required, costs can escalate significantly.
Data recovery — Restoring encrypted or deleted data from backups (assuming you have them) takes time and money. If you don't have tested backups, you're either paying a ransom or starting over.
Legal costs — If customer or employee data was compromised, you have notification obligations under the Privacy Act 2020. Engaging a lawyer to advise on obligations and draft notifications is not optional.
Regulatory fines — The Privacy Commissioner can take action against organisations that fail to notify a notifiable privacy breach or demonstrate adequate data protection. While fines are still modest by international standards, the reputational consequences of a public investigation are not.
Business downtime — IBM's Cost of a Data Breach Report 2023 puts the average downtime from a breach at 23 days. For a business that depends on operational systems, that's three weeks of impaired or zero revenue.
The costs most businesses don't see coming
Customer loss — A 2023 KPMG survey found that 78% of New Zealanders say they would stop using a business if it experienced a data breach involving their information. For a business with a loyal client base built over years, the announcement of a breach can permanently shift relationships.
Staff time — The operational disruption of a breach pulls key people away from their jobs for weeks or months. This is rarely quantified but consistently reported as one of the most painful aspects of recovery.
Insurance premium increases — Cyber insurance premiums have risen dramatically following a breach, particularly if the insurer's investigation finds basic controls weren't in place. Some businesses become uninsurable after a significant incident.
Supplier and partner scrutiny — If you hold data from larger clients or government agencies, a breach may trigger a contractual audit and can end the relationship.
What NZ SMBs are actually being hit with
CERT NZ's incident data shows the most common attack types affecting NZ SMBs are:
- Phishing — credential theft leading to email or banking account compromise (47% of reports)
- Business email compromise — impersonation leading to fraudulent payments
- Ransomware — data encrypted, operations shut down until payment or recovery
- Credential stuffing — reused passwords used to access business systems
The ACSC's Small Business Cyber Security Guide estimates that 60% of small businesses that experience a significant cyberattack close within six months.
What changes the outcome
Businesses that recover quickly share three characteristics: they had MFA on critical accounts, they had offline backups they'd actually tested, and their staff knew what a phishing email looked like.
None of these are expensive. All three are trainable in an afternoon.
For a practical starting point on what to do before and during an incident, see our guide on what to do in the first 24 hours after ransomware. SecureAZ training covers phishing recognition, credential hygiene, and incident reporting so your team is the line of defence — not the vulnerability. Start free.