What Does a Data Breach Cost a Small Business in the UK?
By Daniel Agyemang Prempeh, Founder, DefendVistaLast reviewed:
Real cost ranges from UK SME ransomware and data loss incidents, with a model you can run for your own operation in an afternoon.
Most published breach cost figures come from IBM, Ponemon or Verizon, all weighted heavily toward enterprises. For UK SMEs the numbers look very different, often worse on a per revenue basis, and almost always underestimated by the leadership team beforehand. This guide breaks down the real cost line items we see in haulage, warehousing and professional services incidents, and gives you a framework to model your own exposure honestly.
The headline numbers
UK SME breaches typically cost between £15,000 and £250,000 in direct recovery. For transport and logistics operators, operational losses commonly double or triple that figure. A mid sized haulier with a three day TMS outage routinely passes £500,000 once contract penalties, lost loads and customer churn are counted. The KNP Logistics ransomware incident contributed to the collapse of a 158 year old business with 730 staff, which is the worst case but not a unique one.
Direct recovery costs
Incident response retainer activation (£8,000 to £40,000), specialist forensic investigation (£15,000 to £80,000), legal counsel and regulatory advice (£5,000 to £25,000), hardware replacement where systems cannot be cleaned (£10,000 to £60,000), overtime for IT and operations (£5,000 to £30,000), and, if the conversation gets that far, ransom negotiation specialists (£15,000 to £50,000). Most of this sits outside any normal budget line and lands in the same month.
Operational losses
Downtime is usually the largest single number. For a haulier with £40m revenue, daily turnover is around £155,000. A three day outage at 60 percent operational capacity is over £180,000 in lost revenue before SLA penalties. Customer service teams will absorb overtime, agency drivers may need to be hired, and refrigerated loads can be lost outright if the planning system is down for more than 12 hours. Warehouse operators face penalty clauses for missed pick rates and inventory accuracy that bite within 48 hours.
Regulatory and legal costs
An ICO investigation triggered by a notifiable breach typically runs 6 to 12 months. Legal costs for a competent SME response usually land between £20,000 and £75,000. ICO fines for SMEs are usually moderate, but enforcement notices and undertakings come with mandatory remediation costs that can run to six figures. Class action threats are now realistic following the EasyJet and BA judgments, though they remain rare for SMEs.
Reputational and contractual costs
Lost customers, lost tenders and lost trust. We have seen a 60 vehicle haulier lose its largest customer (28 percent of revenue) following a public ransomware incident, even after recovery was clean. Tender desks at major retailers will ask about cyber incidents going back three years, and a notifiable breach often disqualifies you from frameworks during the recertification window.
Insurance: cover, not cure
A typical UK cyber policy at SME level pays for incident response, some recovery costs and limited business interruption. It will not cover pre existing weaknesses, will reduce payouts if stated controls were not in place, and frequently excludes payments to sanctioned actors. Across the SME incidents we have worked, insurers paid roughly 35 to 70 percent of the total economic loss.
Building your own estimate in an afternoon
Take your annual revenue, divide by 250 working days to get daily turnover. Assume realistic downtime: 24 hours for a well prepared operator, 72 to 120 hours otherwise. Add £40,000 to £100,000 for direct recovery, £15,000 to £40,000 for legal and regulatory, and 5 to 15 percent customer churn over the following 12 months. Compare that to the cost of putting the controls in place (typically £15,000 to £60,000 for a 50 to 200 staff operator). The maths is rarely close. Our breach cost calculator runs this model with your actual numbers.
Frequently asked questions
Does cyber insurance cover all of this?+
No. Most policies cover incident response and partial recovery, but exclude pre existing weaknesses and require stated controls (MFA, backups, EDR, training) to be in place at the time of the incident. Misrepresentation invalidates the claim.
What is the single biggest hidden cost?+
Customer churn after a public incident. Customers who leave for a competitor rarely come back. For SLA driven contracts, the loss often runs 18 to 36 months beyond the technical recovery.
How long until things are back to normal?+
Operational IT systems usually within 1 to 2 weeks. Full forensic close out and ICO sign off within 3 to 9 months. Customer trust and tender eligibility within 12 to 36 months, depending on how the public communications were handled.
Are smaller operators really targeted?+
Yes. Ransomware groups now run partly automated scanning that picks UK SMEs by revenue band. The 30 to 250 employee range is the current sweet spot: large enough to pay, too small to have a mature SOC.
Next step
Want to talk this through?
Book a free 30 minute consultation. No sales pitch, just clear answers.
Book free consultation