902M records leaked since 2025. SMBs took 63% of the hits.
512 breaches since January 2025 exposed more than 902 million records, according to Proton’s Data Breach Observatory update published today. The detail that should jolt EU leadership teams is this: small and mid-sized businesses accounted for 63 percent of those incidents, and nearly half of the most critical ones.
This is not a survey of press releases. Proton’s observatory tracks leaks circulating on dark web markets and forums. It surfaces breaches many companies never disclose, despite GDPR’s 72-hour notification rule. The picture is clear. Breach visibility is rising, attacker volume is steady, and the victims are usually not the headline brands.
The breach profile has shifted to common PII, at scale
The data types exposed make day-to-day business operations the attack surface. Names and emails appeared in nearly 9 out of 10 breaches. Contact information was present in three quarters of cases. Passwords were found in 47 percent of incidents, and names paired with physical addresses in 42 percent. Highly sensitive personal data showed up in 37 percent of breaches, while financial information appeared in roughly 5 percent.
This portfolio fuels the attacks EU teams actually face: phishing, credential stuffing, vishing, and account takeover. Proton flags a vishing campaign in early 2026 that exposed tens of millions of records, a reminder that phone numbers and voice workflows are now part of the blast radius. If your CRM or help desk holds unneeded phone fields, that excess is risk, not convenience.
Average breach costs are estimated at 4.88 million dollars, which many SMB leaders dismiss as an enterprise problem. The observatory’s distribution shows why that mindset fails. Among breaches with more than 100,000 records, SMBs still made up 60 percent of cases, and the smallest firms, with 1 to 49 employees, represented 42 percent. For a 60-person retailer, a six figure incident is not survivable without cutting growth or headcount.
Retail tops the victim list with 25 percent of breached companies. Technology follows at 12 percent, media and entertainment at 11 percent. These sectors collect identity and contact data at scale, often across multiple clouds and vendors. That fragmentation is the adversary’s friend. The more systems that store email, names, and passwords, the easier it is for one weak link to hand over the keys.
Dark web telemetry is now a compliance tool
The practical shift is that dark web monitoring has become a first source of truth. Many incidents in this dataset were never publicly disclosed. Under GDPR, failure to detect and report a breach is not a safe harbor. It is a separate liability. If your incident response plan waits for a vendor email, you will be late, and the regulator will not care who “owned” the system.
This also changes procurement. Tools that minimize credential reuse and reduce stored personal data do more than improve security posture. They lower breach notification scope and regulatory exposure when something goes wrong. A password manager that enforces unique, long credentials across SaaS is not optional anymore, it is insurance against the 47 percent of breaches where passwords appear. Consolidating documents and contacts into fewer, EU-controlled systems reduces the places your users’ PII can leak from. Yes, that sometimes means more setup and governance work up front. It pays for itself the first time you avoid a mass reset and regulator call.
Why This Matters
For EU SMBs still running on Gmail and a sprawl of third party SaaS, this dataset is a red flag. Make two moves this quarter: enforce unique credentials with an EU password manager like Proton Pass, and reduce PII sprawl by consolidating files and contacts into an EU-controlled platform such as Nextcloud. Nextcloud requires more setup than Google Drive, but it keeps contact data and documents under your control, which limits both breach blast radius and GDPR exposure.
This is the second Proton dataset in six months pointing at the same target, with the SMB Cybersecurity Report 2026 echoing the trend. If you process consumer emails at retail scale or publish in media, budget for dark web monitoring and a 72-hour notification playbook by Q2. The fine for late disclosure will be more expensive than the tooling.
Sources
- Proton, Data Breach Observatory update, March 2026: https://proton.me/blog/data-breach-observatory-2026
- Proton, SMB Cybersecurity Report 2026: https://proton.me/blog/smb-cybersecurity-report-2026
Share this article
EU Alternatives Mentioned
Proton Drive is an end-to-end encrypted cloud storage service from Proton AG, the Swiss company behind Proton Mail. Launched in 2022, it encrypts all files and metadata client-side before upload — Proton has zero access to your data. It integrates with the Proton ecosystem (Mail, Calendar, VPN, Pass) and offers photo backup, file versioning, and secure sharing links. Free tier includes 5 GB; paid plans up to 3 TB.
Proton Mail is an end-to-end encrypted email service founded in 2013 at CERN by scientists Andy Yen, Jason Stockman, and Wei Sun. Headquartered in Geneva, Switzerland, it uses zero-access encryption — meaning Proton itself cannot read your emails. All infrastructure is located in Switzerland (including a former military bunker under 1,000 meters of granite). Proton Mail is open source, independently audited, and serves 100+ million users across Proton's ecosystem.
Complete collaborative office suite from Switzerland. Includes email, calendar, contacts, video conferencing, cloud storage (kDrive), and online document editing. A privacy-focused alternative to Google Workspace.
Stay secure and save time with Proton Pass, designed to help you store important files securely and easily while organizing your digital life. It supports features like email aliases and integrated 2FA for enhanced security.
Also Mentioned
Say "hello" to a different messaging experience. An unexpected focus on privacy, combined with all of the features you expect.
SoundCloud is an online audio distribution platform that allows users to upload, share, and promote music and audio content. It enables independent artists to reach a global audience and provides listeners with access to a vast library of tracks, podcasts, and sound recordings across various genres.
GMX (Global Mail eXchange) has been providing free email since 1997, making it one of Europe's oldest webmail platforms. Headquartered in Montabaur, Germany and operated by 1&1 Mail & Media Applications SE under the United Internet AG umbrella, GMX serves approximately 20 million active users. The free tier includes a generous 65 GB of email storage — far exceeding most competitors — while premium plans add up to 250 GB cloud storage and remove advertisements.
Google Workspace is a comprehensive suite of cloud-based productivity and collaboration tools developed by Google. It is designed to facilitate real-time collaboration and communication within organizations. The suite includes applications such as Google Docs, Sheets, and Slides for document creation and editing, Google Meet for video conferencing, and Gmail for email communication. Google Workspace offers customizable email domains and integrates seamlessly with third-party applications, enhancing its utility for businesses of all sizes. The platform also provides advanced security and administrative controls, making it suitable for organizations with specific compliance needs. Users benefit from cloud storage via Google Drive and task management capabilities through Google Tasks. Primarily targeted at businesses, educational institutions, and non-profits, Google Workspace supports mobile access through dedicated apps, allowing users to work from anywhere. It operates under a subscription-based pricing model, with various plans available depending on the size and needs of the organization. It is important to note that Google Workspace is a US-based service, and user data is stored in the United States, subject to US data laws such as the CLOUD Act and FISA 702.
Mailo is a comprehensive email service designed to meet the needs of individuals and businesses seeking secure, reliable, and EU-compliant communication solutions. Hosted entirely in EU data centers, Mailo ensures that your data remains protected under stringent GDPR regulations, providing peace of mind for privacy-conscious users. Key features include support for custom domains, an integrated calendar and contacts system, and advanced spam filtering to keep your inbox clean and organized. Mailo also offers robust security measures such as two-factor authentication and email alias management, enhancing both security and flexibility. The service is ideal for European businesses, privacy-focused individuals, and anyone looking for a dependable email platform with strong data sovereignty. Mailo's pricing model is transparent and competitive, offering various plans to suit different needs and budgets. With mobile and desktop applications, users can access their emails seamlessly across devices, making Mailo a versatile choice for modern communication needs.
.png)
Wire is a secure collaboration platform founded in 2012 by Janus Friis (Skype co-founder) and headquartered in Zug, Switzerland. It offers end-to-end encrypted messaging, voice/video calls, and file sharing for teams. Wire is open source, independently audited, and used by government agencies and enterprises across Europe for classified communications. It supports self-hosted deployment for organizations requiring full data sovereignty.
Threema is a Swiss encrypted messenger founded in 2012 by Manuel Kasper in Pfäffikon, Switzerland. Unlike most messaging apps, Threema requires no phone number or email to register — users get a random Threema ID, enabling truly anonymous communication. All messages, calls, and files are end-to-end encrypted, and metadata is minimized by design. Threema is fully open source and has been independently audited. It's widely adopted in German-speaking countries and used by the Swiss government and military.
Gmail is Google's email service, used by over 1.8 billion people worldwide. Google scans email content for Smart Features and ad personalization, and all data is stored on US servers accessible under the CLOUD Act and FISA 702 without EU judicial oversight.
Nextcloud is a self-hosted cloud storage solution designed to provide secure and compliant data management for individuals and organizations. It offers end-to-end encryption for files, ensuring that your data remains private and protected. With GDPR-compliant data processing, Nextcloud is an ideal choice for those prioritizing data sovereignty and privacy, especially within the European Union. Key features include version control for file revisions, collaborative document editing, and two-factor authentication support, making it a robust tool for both personal and professional use. The platform is extensible with third-party apps, allowing users to customize their experience according to their needs. Nextcloud is suitable for businesses, educational institutions, and privacy-conscious individuals who require a reliable and secure cloud storage solution. With cross-platform mobile and desktop apps, users can access their data anytime, anywhere. Pricing varies based on the deployment model, with options for both free and enterprise-level support. By hosting data within the EU, Nextcloud ensures compliance with stringent data protection regulations, offering peace of mind to its users.
Explore More EU Alternatives
Discover hundreds of European alternatives across all categories.
Browse All Categories