70% of small to mid-sized businesses (SMBs) believe that losses from a successful cyberattack on their firm would not exceed $25,000, while over half think total damages would remain under $10,000, a new AppRiver survey shows. This implies that small business owners are grossly underestimating the amount of money they may lose after a cyberattack, because Kaspersky research indicates that breach costs in North America average $149,000 per incident.

The study also found that while over 70% of SMBs were targeted in a phishing campaign in the last three months, a mere 38% protect themselves by installing security patches as soon as they are available. According to Geoff Bibby of AppRiver, the survey reveals “fatalism and a false sense of security” as common attitudes among business owners, both of which “are signs that they need more straightforward education and awareness,” instead of fear-based messages.

Read more: Small businesses underestimate financial damage of cyberattacks