SMBs face costs of up to $2.5 million after a data breach