The number of identity theft reports shot up from about 86,000 in 2001 to a peak of 490,000 reports in 2015, according to the Federal Trade Commission.

The study also found that almost half of the small business owners surveyed conduct no regular audits of their security protocols, and three in 10 have never performed an audit.