"60% of small businesses close within six months of a cyberattack" — the statistic with no source

You have seen this one. It turns up in sales decks, insurance brochures, small-business checklists and, at one point, in a bill before the US Congress:

“60% of small businesses go out of business within six months of a cyberattack.”

It is a powerful number. It is also, as far as anyone has been able to establish, made up. Here is the trail.

Where it first appears

In 2017 the reporter Joseph Marks at Nextgov traced the figure back as far as it goes. His best explanation is a September 2011 Business Insider article by a small-business technology writer. The article ends with what appears to be the first appearance of the 60% figure, with no citation. The writer told Nextgov he believed an expert he had interviewed gave him the number, but could not remember who.

A month later, in October 2011, the National Cyber Security Alliance (NCSA) put out a press release that linked back to that article. From then on the figure was usually credited to the NCSA.

How far it travelled

According to Nextgov and to Eric Chabrow’s reporting at BankInfoSecurity:

• In April 2015, a witness told a congressional hearing that “over 60 percent of those attacked go out of business.”
• In March 2017, a Commissioner of the Federal Trade Commission and a director at NIST both used the figure in testimony to the House Small Business Committee.
• In May 2017 it appeared in the text of H.R. 2105, the NIST Small Business Cybersecurity Act, which passed the House Science Committee. The Chairman of that committee credited it to the NCSA.
• A Senate companion bill and a senator’s letter to Amazon used it too.

The source says it isn’t theirs

When asked, NCSA’s executive director, Michael Kaiser, said the statistic “is not from NCSA and its original source cannot be confirmed”, and recommended “that media, policymakers, small businesses and others not use that statistic.” NCSA staff had first suggested it came from a 2012 Symantec-sponsored study. Symantec said it had not provided the figure.

After the reporting, the House committee and a senator’s office both said the statistic would be removed from the bills, and a NIST spokesperson said it would come out of NIST’s documents.

It did not die. Two months later, the Chairman of the House Small Business Committee used it again in his opening statement to a hearing on cyber insurance. And a small-business security checklist published in January 2026 still repeats it, this time credited to Forbes.

What we actually know

Very little, which is the honest answer and the reason the made-up one spreads.

• Nobody measures closures caused by cyberattacks. There is no public dataset that follows small firms after an incident and records whether they survive.
• Small businesses close a lot anyway. Chabrow points to US Bureau of Labor Statistics data: roughly one in five new businesses close within a year and about half within five years, with or without a cyberattack. A survey that finds attacked firms later closed tells you nothing unless it compares them with firms that weren’t attacked.
• “Cyberattack” can mean almost anything, from a phishing email to a full ransomware lockout. A single rate covering all of it was never going to be meaningful.

None of this means attacks are harmless to small firms. Ransomware can and does push small businesses over the edge. But “it can kill you” is true and “60% die” is invented, and the invented version does damage of its own: it makes the threat sound so fatal that some owners decide there is no point trying.

How to spot the next one

The same pattern turns up again and again. Before you repeat a security statistic:

1. Click through to the source. If the link goes to another article quoting it, keep clicking. If the trail ends in a sales page or nowhere, stop.
2. Ask who measured it, and how. A real figure has a sample, a method and a date.
3. Be suspicious of round numbers that never change. The world moved on since 2011; this number didn’t.
4. Check whether the credited source agrees. Here, it publicly didn’t.

This is the first in a series. Last week we did the same thing for the numbers people quote about AI and cyberattacks: 68 incidents graded by who actually confirms them. If there is a statistic you would like us to trace, tell us.

And if you want a number about ransomware that is real, dated and sourced, ours is published every day: check whether a gang has named your company, or see today’s Ransom Index.