This is a pretty concerning statistic. Especially as the last estimate I saw of the cost to a business of a breach of sensitive data was approximately $210 per record compromised. That can add up pretty quickly, especially for a small business.
Data security (not just digital, mind you) is important. The costs of failure are huge. This is not something that even small business can afford to ignore. Policies, procedures, and pro-activity will pay huge benefits in the long run. The alternative can be a business-ender!