The number you are not budgeting for
Most accounting firm owners we meet can tell us their revenue per client, their average invoice, and the dollar value of their book of business. Very few can tell us what a single breach would cost them.
This is the scary part: the number is almost always larger than they think, and almost none of it is money they have set aside.
The IBM Cost of a Data Breach Report puts the average small-business breach at around 3 to 4 million dollars. That number is scary, but it mixes Fortune 500 incidents with side hustles, which is not useful if you run a real firm with real clients. So let us do the math for a specific case: a growing firm with 400 client returns a year, an average fee of $450, and three employees including the owner. A realistic mid-scale tax and accounting firm.
Five cost buckets you will actually pay
Here is how the money moves after a breach. This is not theoretical. These are the invoices that hit your desk.
1. Notification and forensics
When you discover a breach, the clock starts. Most states require client notification within 30 to 60 days. Some, like California and New York, require you to engage a forensic investigator before you even know what to say in the notification.
- Forensic investigation: $15,000 to $75,000 for a small firm incident
- Client notification mailing and handling: $4 to $10 per client ($1,600 to $4,000 for 400 clients)
- Credit monitoring offered to affected clients: $10 to $30 per client per year
That is between $20,600 and $91,000 on day one, before you have even talked to a lawyer.
2. Legal fees
You will need a breach coach. Most firms do not have one on retainer because they do not know they are supposed to. Fees for cyber-specialized counsel start at $450 per hour and do not stop for weeks.
- Breach coach engagement: $10,000 to $40,000 for a small incident
- State notification review (per affected state): $2,000 to $8,000
- IRS and state agency response: variable, often $5,000+ in professional hours
3. Regulatory penalties
The FTC Safeguards Rule carries fines of up to $50,644 per violation for the current cycle. Each client whose data was exposed can be treated as a separate violation. In practice, the FTC negotiates. In practice, it still hurts.
State attorneys general pile on. California, New York, Illinois, Massachusetts, Texas, and New Jersey all have aggressive data-breach statutes with teeth. For the IRS, an enforcement action under Section 7216 carries its own penalty of up to $1,000 per improperly disclosed return, with imprisonment theoretically on the table for willful violations.
4. Business interruption
During the active incident, you do not file returns. Your team is on calls with lawyers, forensic investigators, and clients who are calling you in a panic. The median small-business breach causes eight business days of significant disruption.
At our example firm, eight days in the middle of a filing season is roughly $14,400 in direct revenue at risk before you factor in the extensions, the missed deadlines, and the clients who were counting on the refund date you promised them.
5. Client churn (the biggest line item no one budgets for)
Research consistently shows small-business breach notifications drive 25 to 40 percent client attrition within 12 months. Clients do not always leave immediately. They leave at the next renewal window, quietly, with a note that says they found someone local.
For our 400-client firm at $450 per return, losing even 25 percent of clients represents $45,000 of annual recurring revenue walking out the door, and the cost to replace those clients through marketing typically runs 3 to 5 times the first-year fee. You did not just lose $45,000. You lost $45,000 plus the $135,000 to $225,000 it would take to replace them.
The total
Add up a realistic small-firm breach scenario:
- Notification, forensics, credit monitoring: $30,000 to $90,000
- Legal and regulatory response: $20,000 to $80,000
- Regulatory penalties: $0 to $100,000+ depending on posture and cooperation
- Business interruption: $10,000 to $25,000
- Client churn and replacement cost: $180,000 to $270,000 over the next 24 months
Low end: $240,000. Upper end: well past $500,000. This is why cyber insurance exists. This is also why cyber insurance now requires evidence of a WISP, endpoint protection, and multi-factor authentication before they will write a policy.
Your 10-minute exposure worksheet
You can estimate your own breach exposure in less time than it takes to make coffee. Answer these six questions honestly.
- How many active client records do you hold? Multiply by $10 for baseline notification and monitoring cost.
- What percentage of your book would you expect to lose if you had to send a breach notice tomorrow? Multiply by average annual fee times one year of revenue to get churn exposure. Then multiply that number by 4 to account for replacement cost.
- Do you carry cyber insurance? If yes, what is the deductible? That number is the floor of your direct financial exposure.
- Does your current setup include business-grade endpoint protection, a 24/7 security operations center, and multi-factor authentication on every client-data system? If any of those are no, insurers will often deny the claim.
- Do you have a written incident response plan that names your breach coach and insurance contact? If no, add two weeks of chaos to your timeline.
- Can you produce your WISP, training records, and most recent phishing simulation in under five minutes? If no, you will be negotiating from weakness with regulators.
What to do with the number
When you see the number, three things happen. First, you stop thinking about cybersecurity as a $125 per month line item and start thinking about it as insurance against a quarter-million-dollar hit. Second, you realize your general business insurance does not actually cover most of this. Third, you move.
The firms that sleep well are not the ones that spent the most on security. They are the ones that made a deliberate, documented decision about what they were doing and why. The ones that, if the call comes, can pick up the phone and know exactly what happens in the next 72 hours.
A $200 per month security program does not prevent every incident. It prevents the incidents that would destroy your firm, and it saves the ones that do happen from becoming headlines.
If you want help running the numbers specific to your firm, our team has built an exposure worksheet in the format the insurance carriers use. Twenty minutes, your numbers, a clear picture.
