Identity Theft Resource Center 2025 Business Impact Report: Costs from Cybercrimes Are Being Passed to Consumers

In 2025, more than 80 percent of small businesses reported being the victim of a cybercrime; AI attacks are believed to be a leading cause of security or data breaches

SAN DIEGO, Dec. 10, 2025 /PRNewswire/ -- The Identity Theft Resource Center^® (ITRC), a nationally recognized nonprofit organization established to support victims of identity crime, has published its annual report on the impacts of identity crimes and cyberattacks on small businesses and solopreneurs – the 2025 Business Impact Report, supported by Mitek.

For the report, the ITRC surveyed 662 small business owners or executives at a company of 500 or fewer employees. According to the responses, cyberattacks are a near-universal threat, with a shift toward Artificial Intelligence (AI) powered attacks. Eighty-one (81) percent of small businesses reported suffering a security breach, a data breach or both in the past year. AI-powered attacks were identified as a root cause in more than 40 percent of cyber events, a pivot from internal risks to external, technologically advanced adversaries. 

Download the ITRC's 2025 Business Impact Report

Among breached small businesses, 62.5 percent reported a total financial impact—including lost revenue, remediation costs and fines—of more than $250,000 in 2025. Within that group, more than a third of all victims (36.7 percent) faced costs exceeding $500,000, an increase from 2024.

Increased costs are forcing small businesses to significantly change the mix of financing their recovery from a cyber incident. For the first time, 38.3 percent of small businesses leaders reported they "raised prices" to address the financial impacts of an incident. This creates a hidden "cyber tax" that helps fuel inflation.

"The current landscape is not a fair fight and presents both a drag on our economy and a threat to national security," said James E. Lee, President of the Identity Theft Resource Center. "Our national economy is linked to the cybersecurity of our small business community. The data in this report is startling and should be a wake-up call for everyone."

"We cannot treat cybersecurity as a cost of doing business that only falls on the shoulders of individual entrepreneurs, their employees and customers whose lives and livelihoods are impacted," Lee continued. "It is a national economic imperative that requires serious dialogue and action about the role of public policy in leveling the playing field by exploring state and federal initiatives, along with public-private partnerships, to alleviate this burden."

"When identity fraud strikes, real people pay the price," said Kerry Cantley, VP of Digital Banking Strategy at Mitek Systems. "As AI-driven threats grow, we must evolve trust and security to match. Mitek is proud to support the Identity Theft Resource Center in illuminating the human and economic toll of cybercrime and advancing solutions that protect what's real."

Other findings in the 2025 Business Impact Report include:

• Business leaders' confidence in their cybersecurity preparedness has collapsed. The percentage of small business leaders who felt "very prepared" for a cyberattack plummeted in 2025 to 38.4 percent, compared to 56.5 percent in 2024.
• There's a disconnect between the perception of risk and the adoption of basic security controls. Despite a heightened sense of alarm among business leaders, the implementation of critical security measures (like multi-factor authentication) declined from 33.6 percent in 2024 to 27.2 percent in 2025.
• Opinions are mixed on AI. Most small business leaders are planning for AI-driven attacks and would embrace AI security tools. However, they are split on who should be responsible for protecting people from AI-enabled cybercrime.

The ITRC offers a range of low and no-cost tools to help small businesses. To learn more, click here. Consumers can receive free live victim support or guidance from a knowledgeable advisor by calling or texting 888.400.5530 or visiting www.idtheftcenter.org to live chat. 

About the ITRC 2025 Business Impact Report

The ITRC, using the SurveyMonkey platform, conducted an online survey to explore the impacts of cybercrimes on small businesses as defined by the U.S. Small Business Administration. The survey was conducted in August 2025, covering the previous 12 months unless otherwise noted in a specific question. The online questionnaire was completed by 662 people selected by SurveyMonkey. The respondents met the criteria of being a small business owner or executive at a company of 500 or fewer employees, including solopreneurs and gig workers. The responses also reflect a wide range of industries with a concentration in financial services, technology, manufacturing and retail entities.

About the Identity Theft Resource Center

Founded in 1999, the Identity Theft Resource Center^® (ITRC) is a national nonprofit organization established to empower and guide consumers, victims, business and government to minimize risk and mitigate the impact of identity compromise and crime. Through public and private support, the ITRC provides no-cost victim assistance and consumer education through its website live chat, idtheftcenter.org, and toll-free phone number 888.400.5530. The ITRC also equips consumers and businesses with information about recent data breaches through its data breach tracking tool. The ITRC offers help to specific populations, including the deaf/hard of hearing and blind/low vision communities. 

About Mitek

Mitek Systems protects what's real across digital interactions in a world of evolving threats. Mitek helps businesses verify identities, prevent fraud before it happens, and deliver secure, seamless digital experiences in the face of rapidly advancing AI-generated threats. From account opening to authentication and deposit, Mitek's technology safeguards critical digital interactions. More than 7,000 organizations rely on Mitek to protect their most important customer connections and stay ahead of emerging risks. Learn more at 
www.miteksystems.com.

SOURCE Identity Theft Resource Center