A Backup Only Counts If It Restores
Un estudio de Verizon de 2026 situó la violación típica en pequeñas empresas en cerca de $38,000, al 16 de junio de 2026. Una copia de seguridad solo ayuda si realmente se puede restaurar.
Your backup can be running every night and still fail on the one morning you need it, if nobody has ever tested putting the files back.
What to do this week: Pick one important folder, restore it to a spare location, and time how long it takes.
Two large 2026 studies and federal complaint data point the same way. Verizon's Breach Impact Study, dated June 16, 2026, found ransomware in 39% of small-business cyber-insurance claims, while Sophos's 2026 survey found 66% of organizations whose data was encrypted got it back using backups, up from 54% the year before, though 48% still paid a ransom, and recovery cost more than last year.
The small-business bill is not the headline bill
Verizon reported the median financial impact for businesses with revenue under $25 million was about $38,000, as of its June 16, 2026, study of roughly 70,000 cyber-insurance claims. In the worst 2.5% of cases, Verizon's summary says losses passed 7% of annual revenue.
Our calculation: for a shop with $500,000 in yearly sales, 7% is $35,000. Verizon's worst cases for small businesses ran above 7% of revenue, so for a shop that size the worst case means a loss of $35,000 or more. For many small shops, that's a year of thin profit.
Sophos surveyed 2,158 information-technology leaders at organizations with 100 to 5,000 employees that were hit in the past year, as reported in its 2026 study. It found 66% of organizations with encrypted data recovered using backups, up from 54% in 2025, while the average recovery cost excluding ransom rose 11% to $1.7 million across all surveyed organizations — a figure dominated by larger organizations, not a small-shop estimate.
The FBI's Internet Crime Complaint Center (IC3) counted 3,611 ransomware complaints in 2025, with reported losses of $32,320,105, in its 2025 annual report. IC3 states that figure does not normally include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services, and covers only what was reported to IC3 — so it understates the full cost of getting back to work, rather than measuring total recovery cost.
A backup is like a spare tire in the trunk. Checking that it exists is not the same as checking that it holds air and that someone in the car can change it in the rain.
Email and identity, not only broken software
Sophos reported malicious email and phishing together accounted for half of the incidents it counted in 2026, and that 79% started with an identity-based approach. Those findings match the practical order of work: protect sign-ins and email first, then confirm the backup can carry the business while systems are cleaned.
Sophos also found only 34% of organizations with 100 to 250 employees stopped an attack before encryption or extortion, compared with 46% at the largest size it reported. A very small Allegan shop is below even that first bracket, so outside help and simple rehearsed steps matter more, not less.
The other side
All three sources have limits. Verizon's claims data covers organizations that had insurance and filed claims, Sophos is a security vendor surveying its market, and IC3 counts only complaints reported to it; none is a census of Allegan County businesses. Their agreement on direction — backups used more, recovery still expensive — is the useful part, and this draft does not average their different dollar figures together.
What this means for Southwest Michigan
A restaurant in Otsego, a contractor in Allegan, or a retailer in Plainwell does not need an enterprise recovery room. It needs its customer list, accounting file, and key documents back in hours, one copy that ransomware on the main computer cannot reach, and a named person who has done a restore once before.
Write down how long the test restore took. That time, plus the cost of being closed while it happens, is the number to compare against the price of a better backup — not a sales brochure's promise.
One thing to do this week: run the single-folder restore test and write the elapsed time on the backup checklist.
Disclosure: Cybercave Technologies, LLC provides IT services to small businesses. No company named in this article paid for, sponsored, or reviewed it.
This article is general information, not advice for your specific situation.
Sources (accessed October 17, 2026)
- Primary — Verizon, 2026 Breach Impact Study (June 16, 2026; about 70,000 cyber-insurance claims; SMB median about $38,000, ransomware in 39% of SMB claims, worst 2.5% over 7% of revenue): https://www.verizon.com/business/resources/reports/2026-breach-impact-study-dbir.pdf
- Primary — Verizon SMB infographic summarizing the 2026 DBIR and Breach Impact Study, accessed October 17, 2026: https://www.verizon.com/business/resources/infographics/2026-dbir-bis-smb-revenue-losses.pdf
- Primary (separate dataset) — Sophos, State of Ransomware 2026 (survey of 2,158 IT leaders hit in the prior year; 66% recovered from backups, average recovery cost $1.7 million excluding ransom across all sizes): https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026 — report PDF (primary): https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf
- HIPAA Journal, 2026, independent summary of Verizon's Breach Impact Study release: https://www.hipaajournal.com/verizon-2026-breach-impact-study/
- Primary (separate dataset) — FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report (3,611 ransomware complaints in 2025; reported losses of $32,320,105; IC3 states that figure does not normally include estimates of lost business, time, wages, files, or equipment, or third-party remediation services): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
Independence note: Verizon sources (1–2) count as one dataset; Sophos (3) is a second, separate primary dataset; FBI IC3 (5) is a third, independent dataset (federal complaint reporting, not derived from Verizon or Sophos). HIPAA Journal (4) merely summarizes Verizon's release and is not counted as an independent dataset. Three independent datasets in total. No X source counted. Distinct from the earlier remote-tools/backup-attacks incident article: this is new 2026 cost-and-recovery evidence, not that incident.
Human-scale math: 7% × $500,000 = $35,000 — our calculation, a hypothetical revenue illustration using Verizon's sourced 7% figure as of June 16, 2026.
General information only. Corrections: support@cybercavetech.com