12% of respondents from smaller middle market firms (with revenue between $10 million to less than $50 million) reported a breach.