What a hacked website really costs a small business

When owners imagine a hack, they picture a bill from a developer. That bill is real, but it’s rarely the biggest cost.

The eight risks of a website hack

Risk	What it means for you
Money	Clean-up fees, emergency developer time, rebuilding, and lost work while the site is down. Australian small businesses lost an average of A$56,600 per reported cybercrime.1 Payment-redirection scams, where a criminal changes your bank details on an invoice, can cost far more.
Google and visibility	Google can flag your site as dangerous with a full-screen red warning, or drop it from search results. Recovering rankings can take months after the site is clean.
Reputation	If your site sends a regular customer to a scam, they remember your name, not the hacker’s. Word of mouth works both ways for local businesses.
Legal duties	If personal details are exposed, you may have to report it. UK GDPR expects serious breaches reported to the ICO within 72 hours. Canada (PIPEDA), New Zealand (Privacy Act 2020) and every US state have breach-notice rules. Australia’s scheme covers many health providers, including small clinics.
Email and trust	Spam sent from your domain can land you on blocklists, so quotes and invoices go to junk folders.
Your customers	Visitors can get malware or be phished using your name. Customer data from forms can be used against them.
Time and stress	For an owner-operator, a hack means days on the phone with hosts and developers instead of earning.
Platform risk	Not a hack, but the same result: losing your site. In September 2026 Weebly began taking sites offline in 67 countries,2 and Squarespace raised prices by up to 26%.3 If you can’t take your site with you, you’re exposed.

The cost nobody budgets for: Google

For a local business, Google is often the biggest source of new enquiries. A hack that adds spam pages or redirects visitors can trigger a “This site may harm your computer” warning, which stops almost everyone. Even after the site is clean and Google lifts the warning, it can take months for rankings to come back.

The cost that hits your inbox

Many owners first notice a hack when customers say they never got a quote. If your server sends spam, your domain lands on blocklists, and real emails start going to junk. Fixing your email reputation is slow.

Check your insurance

Many small business policies exclude cyber incidents, or need you to show you took reasonable steps such as backups and two-step login. Ask your broker what’s covered before you need it.

A note on a famous statistic

You may have read that “60% of small businesses close within six months of a cyber attack.” Nobody can find where it came from. The US National Cyber Security Alliance, often named as the source, has said it isn’t theirs.⁴ The real costs above are serious enough without made-up numbers.

Sources

1. Australian Signals Directorate, Annual Cyber Threat Report 2024–25, business factsheet. ↩

2. Khaleej Times, Weebly websites to shut down in 67 countries. ↩

3. PetaPixel, Squarespace is increasing prices by up to 26% (July 2026). ↩

4. National Cyber Security Alliance, Statement regarding incorrect small business statistic; BankInfoSecurity. ↩