902M records leaked since 2025. SMBs took 63% of the hits.
512 breaches since January 2025 exposed more than 902 million records, according to Proton’s Data Breach Observatory update published today. The detail that should jolt EU leadership teams is this: small and mid-sized businesses accounted for 63 percent of those incidents, and nearly half of the most critical ones.
This is not a survey of press releases. Proton’s observatory tracks leaks circulating on dark web markets and forums. It surfaces breaches many companies never disclose, despite GDPR’s 72-hour notification rule. The picture is clear. Breach visibility is rising, attacker volume is steady, and the victims are usually not the headline brands.
The breach profile has shifted to common PII, at scale
The data types exposed make day-to-day business operations the attack surface. Names and emails appeared in nearly 9 out of 10 breaches. Contact information was present in three quarters of cases. Passwords were found in 47 percent of incidents, and names paired with physical addresses in 42 percent. Highly sensitive personal data showed up in 37 percent of breaches, while financial information appeared in roughly 5 percent.
This portfolio fuels the attacks EU teams actually face: phishing, credential stuffing, vishing, and account takeover. Proton flags a vishing campaign in early 2026 that exposed tens of millions of records, a reminder that phone numbers and voice workflows are now part of the blast radius. If your CRM or help desk holds unneeded phone fields, that excess is risk, not convenience.
Average breach costs are estimated at 4.88 million dollars, which many SMB leaders dismiss as an enterprise problem. The observatory’s distribution shows why that mindset fails. Among breaches with more than 100,000 records, SMBs still made up 60 percent of cases, and the smallest firms, with 1 to 49 employees, represented 42 percent. For a 60-person retailer, a six figure incident is not survivable without cutting growth or headcount.
Retail tops the victim list with 25 percent of breached companies. Technology follows at 12 percent, media and entertainment at 11 percent. These sectors collect identity and contact data at scale, often across multiple clouds and vendors. That fragmentation is the adversary’s friend. The more systems that store email, names, and passwords, the easier it is for one weak link to hand over the keys.
Dark web telemetry is now a compliance tool
The practical shift is that dark web monitoring has become a first source of truth. Many incidents in this dataset were never publicly disclosed. Under GDPR, failure to detect and report a breach is not a safe harbor. It is a separate liability. If your incident response plan waits for a vendor email, you will be late, and the regulator will not care who “owned” the system.
This also changes procurement. Tools that minimize credential reuse and reduce stored personal data do more than improve security posture. They lower breach notification scope and regulatory exposure when something goes wrong. A password manager that enforces unique, long credentials across SaaS is not optional anymore, it is insurance against the 47 percent of breaches where passwords appear. Consolidating documents and contacts into fewer, EU-controlled systems reduces the places your users’ PII can leak from. Yes, that sometimes means more setup and governance work up front. It pays for itself the first time you avoid a mass reset and regulator call.
Why This Matters
For EU SMBs still running on Gmail and a sprawl of third party SaaS, this dataset is a red flag. Make two moves this quarter: enforce unique credentials with an EU password manager like Proton Pass, and reduce PII sprawl by consolidating files and contacts into an EU-controlled platform such as Nextcloud. Nextcloud requires more setup than Google Drive, but it keeps contact data and documents under your control, which limits both breach blast radius and GDPR exposure.
This is the second Proton dataset in six months pointing at the same target, with the SMB Cybersecurity Report 2026 echoing the trend. If you process consumer emails at retail scale or publish in media, budget for dark web monitoring and a 72-hour notification playbook by Q2. The fine for late disclosure will be more expensive than the tooling.
Sources
- Proton, Data Breach Observatory update, March 2026: https://proton.me/blog/data-breach-observatory-2026
- Proton, SMB Cybersecurity Report 2026: https://proton.me/blog/smb-cybersecurity-report-2026
Share this article
EU Alternatives Mentioned
Complete collaborative office suite from Switzerland. Includes email, calendar, contacts, video conferencing, cloud storage (kDrive), and online document editing. A privacy-focused alternative to Google Workspace.
Proton Drive is a secure cloud storage service that allows users to store, share, and collaborate on files with end-to-end encryption. It offers features like file syncing, secure file sharing, and online document editing. Proton Drive is based in Switzerland and is protected by European privacy laws.
Proton Mail offers secure email services with a focus on privacy and digital freedom. It provides encrypted email communication to protect users from spam, tracking, and ads. Proton Mail is part of a suite of tools designed to safeguard personal and business data.
Stay secure and save time with Proton Pass, designed to help you store important files securely and easily while organizing your digital life. It supports features like email aliases and integrated 2FA for enhanced security.
Also Mentioned
Say "hello" to a different messaging experience. An unexpected focus on privacy, combined with all of the features you expect.
GMX offers free email accounts with advanced security features, including spam filters and antivirus protection. Users can manage multiple email addresses within a single account and access their emails through webmail or mobile apps. GMX also provides cloud storage and an online office suite for document creation and editing.
Cloud-based productivity suite offering Gmail, Google Docs, Drive, Meet, and Calendar for businesses and teams of all sizes.
Mailo is a comprehensive email service designed to meet the needs of individuals and businesses seeking secure, reliable, and EU-compliant communication solutions. Hosted entirely in EU data centers, Mailo ensures that your data remains protected under stringent GDPR regulations, providing peace of mind for privacy-conscious users. Key features include support for custom domains, an integrated calendar and contacts system, and advanced spam filtering to keep your inbox clean and organized. Mailo also offers robust security measures such as two-factor authentication and email alias management, enhancing both security and flexibility. The service is ideal for European businesses, privacy-focused individuals, and anyone looking for a dependable email platform with strong data sovereignty. Mailo's pricing model is transparent and competitive, offering various plans to suit different needs and budgets. With mobile and desktop applications, users can access their emails seamlessly across devices, making Mailo a versatile choice for modern communication needs.
Gmail is Google's email service for personal accounts and Google Workspace. It offers search, spam filtering and integration with Google services. Standard Gmail uses provider-managed encryption rather than end-to-end encryption by default. Google states that Gmail message content is not used for advertising; smart features and separately connected Gemini services have distinct data controls.
Wire is a secure communication platform designed for organizations, offering end-to-end encrypted messaging, calls, and file sharing. It provides flexible deployment options including cloud, on-premises, and hybrid solutions. Wire is trusted by enterprises and governments for its security, compliance, and digital sovereignty features.
SoundCloud is an online audio distribution platform that allows users to upload, share, and promote music and audio content. It enables independent artists to reach a global audience and provides listeners with access to a vast library of tracks, podcasts, and sound recordings across various genres.
Nextcloud is a self-hosted cloud storage solution designed to provide secure and compliant data management for individuals and organizations. It offers end-to-end encryption for files, ensuring that your data remains private and protected. With GDPR-compliant data processing, Nextcloud is an ideal choice for those prioritizing data sovereignty and privacy, especially within the European Union. Key features include version control for file revisions, collaborative document editing, and two-factor authentication support, making it a robust tool for both personal and professional use. The platform is extensible with third-party apps, allowing users to customize their experience according to their needs. Nextcloud is suitable for businesses, educational institutions, and privacy-conscious individuals who require a reliable and secure cloud storage solution. With cross-platform mobile and desktop apps, users can access their data anytime, anywhere. Pricing varies based on the deployment model, with options for both free and enterprise-level support. By hosting data within the EU, Nextcloud ensures compliance with stringent data protection regulations, offering peace of mind to its users.
Threema is a Swiss encrypted messenger founded in 2012 by Manuel Kasper in Pfäffikon, Switzerland. Unlike most messaging apps, Threema requires no phone number or email to register — users get a random Threema ID, enabling truly anonymous communication. All messages, calls, and files are end-to-end encrypted, and metadata is minimized by design. Threema is fully open source and has been independently audited. It's widely adopted in German-speaking countries and used by the Swiss government and military.
Explore More EU Alternatives
Discover hundreds of European alternatives across all categories.
Browse All Categories