Cyber Liability on Main Street: Why Your Small Business Is a Target

When I raise cybersecurity with clients, I often hear some version of the same response. “Why would a hacker bother with us? We run a print shop.” Others tell me they run a restaurant, a machine shop, or a mental health practice. It is an understandable reaction, and it is exactly the reaction cybercriminals count on.

Small businesses are attractive targets precisely because they are small. Most do not have an IT department, a security budget, or anyone whose job is to watch for trouble. In 2025, businesses and government agencies reported a record 2,349 data breaches to the North Carolina Department of Justice, affecting more than 9.2 million North Carolinians, according to the NCDOJ 2025 Data Breach Report.

Your Data Is Worth More Than You Think

You may not think of yourself as a data company, but you almost certainly hold information that someone wants. A retailer keeps customer names and payment information. A printer stores client files, artwork, and mailing lists. A manufacturer holds drawings, specifications, and pricing for its customers. A licensed professional, whether an accountant, a counselor, or an engineer, keeps confidential client records. And every business with employees maintains Social Security numbers, direct deposit bank information, and tax forms.

How Small Businesses Get Hacked

Most attacks on small businesses are not sophisticated. Ransomware locks up your files and systems until you pay, and many criminals now copy the data first and threaten to publish it, which can trigger legal obligations even if you restore everything from backups. Phishing emails lead employees to fake login pages that capture their passwords, and a single stolen password is often the starting point for everything else. Vendor compromise allows criminals to reach your business through a provider you trust, such as your IT company, software vendor, or payment processor. Former employees who still have passwords to email, cloud storage, or social media accounts can do real damage. And tech support scams persuade someone on your staff to give a stranger remote access to a company computer by claiming that it is infected.

Collect Less, Keep Less

The simplest way to protect sensitive data is not to have it in the first place. Take an honest inventory of what your business collects and ask whether you actually need it. Many businesses ask for a customer’s date of birth, driver’s license number, or full card number on an order form simply because an old form asked for it. Every piece of information you keep is something you must protect, and something you must report if it is stolen. Where you can, let a specialist hold the most sensitive data for you. Payroll companies such as ADP, Paychex, and Gusto, or a local payroll provider, collect and store your employees’ Social Security numbers and bank account information on secure systems built for that purpose. Card processors such as Square, Stripe, and Clover, or your bank’s merchant services department, handle card numbers so that the full number never needs to sit on your computer or in your filing cabinet. Using these services does not eliminate your responsibility, so read their contracts with the same care you give your other vendor agreements. Shred paper records and delete files you no longer need, because data you have discarded cannot be stolen.

North Carolina Law Puts Obligations on You

North Carolina’s Identity Theft Protection Act applies to businesses that own or license personal information of North Carolina residents. If that information is compromised, you must notify the affected people without unreasonable delay. You must also report the breach to the Consumer Protection Division of the Attorney General’s office, no matter how few people are affected. The NCDOJ explains these requirements on its security breach information page. A failure to comply is treated as an unfair or deceptive trade practice, which can lead to enforcement by the Attorney General and, for anyone actually injured, a private lawsuit.

Licensed professionals may also face discipline from their licensing boards, and those who handle health information answer to HIPAA as well.

Your Contracts Already Allocate Cyber Risk

Many contracts that small businesses sign today, especially with larger customers, include data security requirements, breach notification deadlines, and indemnification clauses that make you responsible for losses caused by a security failure on your end. Manufacturers who supply larger companies or government contractors often find detailed cybersecurity requirements passed down the supply chain to them.

As I noted earlier, indemnification and limitation of liability are the sections where eyes glaze over but the money hides. Read those sections with cyber risk in mind, both in the contracts your customers hand you and in the contracts you sign with your own vendors, such as your IT provider, payment processor, and cloud software companies,

Where to Find Practical Help

Several excellent resources are free. The N.C. Department of Information Technology’s SecureNC program offers plain-language tips and short videos on phishing, passwords, and multifactor authentication. The Federal Trade Commission’s Cybersecurity for Small Business fact sheets are designed to share with employees. Manufacturers can turn to the North Carolina Manufacturing Extension Partnership for cybersecurity assessments and free awareness training. Any business owner can get confidential, no-cost counseling from the Small Business and Technology Development Center.

Insurance Is One Tool, Not the Plan

Cyber insurance can be a sensible part of your plan, so ask your insurance agent whether your current policies cover these losses. Many general liability policies do not. Insurers also increasingly require basic precautions, such as multifactor authentication and regular backups, before they will pay a claim

If you would like to review how your contracts allocate cyber risk, or you want stronger terms in your vendor and customer agreements before you need them, I would be glad to help. Contact Legal Direction to schedule a conversation.