The global average cost of a data breach is USD $4.45 million, according to IBM. That figure is dominated by large enterprise incidents. For a 20-person NZ small business, the numbers are smaller — but still potentially business-ending. Here's a realistic breakdown of what breach costs actually look like for NZ SMBs.
When a data breach occurs at a small business, the costs fall into several distinct categories. Some are obvious (ransom demands, IT remediation). Many are not — and the non-obvious costs frequently exceed the obvious ones.
Direct Incident Response Costs
IT remediation: Rebuilding systems, restoring from backup, reimaging endpoints, and redeploying software. For a small business without an existing managed IT relationship, engaging a specialist incident response firm costs between $200–$500 per hour. A moderate-complexity incident response engagement for a 20-person business might run 40–100 hours — $8,000–$50,000.
Ransom payment: If backups were inadequate and recovery without the decryption key is impractical, some businesses pay ransoms. Average ransomware demands for SMBs range from $10,000 to $200,000 NZD. Payment doesn't guarantee recovery — some ransomware groups take payment and provide non-functional decryption tools, or demand additional payment after the first is made.
Forensic investigation: Understanding what happened, what was accessed, and what the entry point was requires forensic analysis. This is necessary for both insurance claims and for preventing recurrence. Forensic engagements for SMB incidents typically run $5,000–$20,000.
Legal and Compliance Costs
Legal advice: Notification obligations under the NZ Privacy Act 2020, potential civil liability to affected parties, and regulatory response all require legal counsel. For a straightforward incident, expect $2,000–$10,000 in legal fees. A complex incident involving significant personal data exposure can run significantly higher.
Privacy Commissioner notification and investigation: A notifiable breach triggers engagement with the Privacy Commissioner, potentially including an investigation. While there are no fines for first-time notifiable breaches under the Privacy Act, an investigation consumes significant management time and may require remediation commitments.
Business Interruption Costs
The hidden cost that surprises most businesses is the revenue loss from operational downtime. A ransomware attack that takes a 20-person professional services firm offline for two weeks represents: two weeks of staff time that can't be billed, client project delays, potential client compensation claims for missed deadlines, and the overhead of communicating with clients about the situation. For a firm billing $100,000+ per month, two weeks of downtime is a $50,000+ revenue impact — before any other costs.
Reputational Cost
The hardest cost to quantify is client loss following a security incident. Research by Centrify found that 65% of consumers lose trust in a company after a data breach. For a professional services firm where client trust is the primary business asset, a breach that exposes client data to public disclosure carries a reputational cost that extends well beyond the incident itself.
What Cyber Insurance Actually Covers
Cyber insurance policies for NZ SMBs typically cover: incident response costs, ransom payment (subject to limits and sanctions compliance), legal costs and regulatory defence, notification costs, and some business interruption coverage. They do not cover reputational damage or client relationship loss. A policy with $500,000 in coverage costs roughly $2,000–$8,000 per year for a small business — considerably less than the average incident cost it covers.
The realistic cost of a significant data breach for a 20-person NZ business ranges from $50,000 to $300,000, including all cost categories. The preventive security investment that would have stopped most incidents costs a fraction of that annually.
