04/29/2026
Meet Sarah.
Sarah runs a one-person bookkeeping firm in Ohio. About $80K in annual revenue. Great clients. A solid reputation built over 12 years.
One Tuesday morning, she opened what looked like a QuickBooks invoice notification. It wasn't.
A ransomware attack encrypted every file on her computer — client tax returns, payroll records, bank reconciliations, years of data. A pop-up demanded $15,000 in Bitcoin to restore access.
She didn't pay. A local IT firm spent three weeks attempting recovery. Final bill: $6,400.
Her state required her to notify all 34 clients of the potential data breach. She hired an attorney to manage the process: $2,200.
Two clients didn't renew. Lost revenue: ~$9,600.
Total damage: over $17,000. In a single incident.
On an $80K revenue business.
Sarah had E&O insurance coverage. She did not have cyber insurance.
A standalone cyber policy for her firm would have cost $600–$900 per year. It would have covered the IT recovery, the legal fees, client notification costs, and the lost income during downtime.
The insurance math is brutal when you don't have the proper coverage.
