Most cybersecurity advice aimed at small businesses assumes the valuable thing you hold is money. For a business that ships goods, the valuable thing is the list: who your customers are, where they live, when they are usually home, and how they pay.
That list is worth more to a criminal than your bank balance, and it is stored in more places than most owners realize: the order platform, the routing app, the spreadsheet someone exported last spring, the driver’s phone. Data breaches in delivery operations tend to happen through those secondary copies rather than through a dramatic assault on a main server.
This guide covers the whole picture: what data you actually hold, how breaches get in, what one costs, and what to do first. Two pieces go deeper elsewhere. The main types of data breaches breaks down each attack route and which ones realistically reach a small operation, and building a data breach response plan covers the procedure and notification deadlines for the day it happens.
The Bottom Line
- Delivery addresses, phone numbers, and order histories are the assets at risk. They are sellable, they are hard to change after exposure, and they are usually stored in several systems at once.
- Software flaws became the top entry point in 2026, behind 31% of breaches, the first time in 19 years they outranked stolen credentials (Verizon DBIR, 2026).
- Third parties are now involved in 48% of breaches, up 60% year over year. Your order platform, payment processor and routing vendor are part of your attack surface.
- The global average cost of a breach reached USD 4.99 million in 2026, and USD 11.5 million in the United States (IBM Cost of a Data Breach, 2026).
- Start with multi-factor authentication, patching, and deleting data you no longer need. Those three cover most of what actually goes wrong.
Boost customer satisfaction with just a few clicks
Most-Loved Features:
- On-demand drivers
- Real-time GPS tracking
- Delivery confirmation photos
- Over 50% of customers report a smoother delivery experience
What counts as a data breach
A data breach is any incident where someone without authorization gains access to confidential information. It covers far more than hacking.
A laptop stolen from a van is a breach. A misconfigured cloud folder that anyone with the link can open is a breach. An employee emailing a customer export to a personal account is a breach. A ransomware attack that both encrypts your files and copies them out is a breach twice over.
What it is not is every security incident. An attack that knocks your website offline without touching data is disruptive but is not a breach, and the distinction matters because notification obligations attach to data being accessed, not to you having a bad week.
The customer data a delivery operation actually holds
Run an honest inventory and most businesses that deliver find five categories of personal data, spread across more systems than expected.
| Data you hold | Where it usually lives | Why attackers want it |
|---|---|---|
| Names and delivery addresses | Order platform, routing app, printed manifests | Resold for fraud and package theft; identifies high-value homes |
| Phone numbers and emails | Order platform, marketing tool, driver’s phone | Feeds phishing and smishing campaigns against your customers |
| Payment details | Payment processor, point of sale | Direct fraud; also the trigger for card network penalties |
| Order history and delivery notes | Order platform, spreadsheets | “Gate code is 4471,” “leave behind the planter” — operational detail worth real money to a thief |
| Staff and contractor records | Payroll, HR files, onboarding email | Identity theft; credentials for further access |
The fourth row is the one specific to this kind of business and the one most often overlooked. Delivery instructions are a written record of how to get into somebody’s property when they are not there. A florist’s or caterer’s notes field routinely contains more physically sensitive information than the payment record does, and it is almost never treated as sensitive.
The other pattern to notice: nearly every row lives in at least two places. Data exported once and never deleted is the most common source of exposure, because it sits outside whatever protections the original system had. That tension deserves a straight answer, because the same order history that creates the risk is also the raw material for using small business data analytics to find daily improvements. The answer is to keep the analysis inside one system, not to stop looking at your numbers.
How data breaches start
Three routes account for most incidents, and the mix shifted noticeably in 2026.
Unpatched software is now the leading entry point, behind 31% of breaches, the first time in 19 years it has outranked stolen credentials (Verizon DBIR, 2026). The same report found third parties involved in 48% of breaches, a 60% jump year over year, and noted that attackers are using AI to shorten the gap between a vulnerability being published and being exploited from months to hours.
People remain the other half of the story. Mobile social engineering now succeeds at rates 40% higher than traditional email phishing, which matters in an operation where a good deal of business is conducted from phones in vans and kitchens.
Stolen records rarely stay where they were taken. Once a customer list is copied out, it typically surfaces for sale, which is the premise behind dark web monitoring services that watch for a company’s data appearing in criminal marketplaces, and often the first signal a business gets that something went wrong months earlier.
Each of these routes behaves differently and calls for different defenses, which is the subject of our breakdown of the breach types that reach businesses handling customer orders.
What a data breach costs
The global average cost of a data breach reached USD 4.99 million in 2026, with the United States average at USD 11.5 million (IBM Cost of a Data Breach, 2026). Those figures are dominated by large enterprises and are not what a local business should expect to pay.
The costs that actually land on a smaller operation are more mundane and still substantial:
- Forensics and IT remediation, to find out what happened and close it. This is usually the first invoice and rarely the largest.
- Legal advice and notification, including printing and postage for mailed notices where the statute requires them, and credit monitoring where you choose or are required to offer it.
- Card network penalties, if payment data was involved and you were not compliant with security standards at the time.
- Lost trade, the hardest to quantify. Customers who hand over their home address weekly are making a trust decision, and a breach notice interrupts it.
- Staff time, which is almost never budgeted. A serious incident absorbs the owner and the operations lead for weeks.
Recent breaches in delivery and logistics
The sector has had a visible run of incidents, and they illustrate a pattern worth understanding.
A breach at regional parcel carrier OnTrac in April 2025 exposed personal information of more than 40,000 people, including Social Security numbers and some medical records (Fox News). In August 2026, an attack on shipping and logistics company Ceva Logistics reached data belonging to its customers’ customers, with knock-on exposure reported at banks, retailers and Valve (TechCrunch).
The Ceva case is the instructive one for a small business, because almost nobody affected was breached themselves. Their data was taken from a partner. That is the third-party exposure in the Verizon numbers made concrete: when you hand customer addresses to an order platform or a shipping vendor, their security is now part of yours, and their incident becomes your notification obligation.
Which defenses to put in place first
Security spending has sharply diminishing returns past the basics. In rough order of value for a business that delivers:
- Turn on multi-factor authentication everywhere, starting with email, the order platform, and the payment processor. Email first, because whoever controls it can reset everything else.
- Patch promptly. Given that unpatched software is now the leading entry point, enabling automatic updates on phones, laptops and point-of-sale terminals is the single highest-return habit available. Businesses with their own website code or customer portal can go further with vulnerability management tooling that flags known flaws in the components they depend on.
- Delete data you no longer need. Old customer exports, former employees’ records, years of order spreadsheets. Data you don’t hold cannot be stolen, and this costs nothing but an afternoon. The same logic applies to the owner’s own exposure, which is what a personal data removal service addresses by pulling your details back off broker sites that attackers use for research.
- Limit who can export. Most staff need to see today’s deliveries; very few need the ability to download the entire customer list. Set permissions to match.
- Lock down the phones. Screen locks, remote wipe, and no customer lists stored in personal messaging apps or camera rolls. Route information belongs in a system you can revoke access to. Where staff work from cafés, depots and home networks, a VPN that covers multiple devices closes the gap left by untrusted wifi without needing a device for each person.
- Ask your vendors one question. When you sign with an order or routing platform, ask how quickly they will notify you of a breach affecting your data. The answer tells you a lot, and it feeds straight into your own response timeline.
- Get a cyber insurance quote. Even if you decline the policy, the application is a free security assessment, and the questions map neatly onto the gaps you should close.
What to do if it happens anyway
Contain first, investigate second, notify third. Disable the compromised accounts and pull affected machines off the network, but do not wipe anything before it has been preserved for examination.
Then the clock starts. All 50 states have breach notification laws, 20 of them set a numeric deadline between 30 and 60 days, and your obligations follow where your customers live rather than where you operate. The full procedure, the roles to assign, and the state-by-state deadlines are laid out in our guide to building a data breach response plan. Read it before you need it, because the plan is much harder to write during an incident than in advance.
Frequently asked questions
Are small businesses actually targeted, or is this a large-company problem?
Targeted is the wrong frame. Most attacks are opportunistic and automated, scanning for exposed systems and unpatched software regardless of who owns them. A small business is not selected so much as found, which is why basic hygiene does disproportionate work. It is also why the field has grown into a formal discipline with dedicated graduate training such as the cyber security master’s programs now offered by universities. The people your IT provider hires increasingly come from them.
Does using an online ordering or delivery platform make a breach more or less likely?
Usually less likely in absolute terms, since established platforms invest more in security than a small business can. But it changes the shape of the risk: you inherit their exposure, and third parties were involved in 48% of breaches in 2026. The mitigation is to ask about their notification commitments and to avoid keeping your own extra copies of what they already store.
What data do we need to protect most carefully?
Anything that combines a name with something hard to change: a home address, a Social Security number, a driver’s license number, or payment details. Delivery notes deserve the same treatment, since access instructions for a customer’s property are more sensitive than their category suggests.
Do we have to tell customers about every security incident?
No. The duty attaches to personal information being accessed or acquired without authorization, and the precise trigger varies by state. An incident that disrupts operations without exposing data generally does not require notification, but that determination belongs with legal counsel rather than being made in the moment.
Where to start this week
If you do one thing after reading this, inventory what you hold. Walk through every system that touches a customer (orders, routing, payments, marketing, the spreadsheets on someone’s desktop) and write down what personal data is in each and who can reach it.
Almost everyone who does this finds at least one export that should have been deleted years ago and at least one account belonging to someone who no longer works there. Closing those two gaps is free, takes an afternoon, and removes more risk than most of what gets sold as security.
