"Nobody is going to hack me. I'm too small to be noticed." - Small Business Owner
Yes, you're right, Ms. Business Owner. You are not ultimately the target. TARGET(the corp) is the Target.
In fact, that's what happened: a contractor who did work for a TARGET store was hacked and the hackers waited for that contractor to access the payables system to submit their work invoice. BOOM, TARGET is hacked.
But they came through you, Small Business Owner, because you thought:
"Nobody is going to hack me. I'm too small to be noticed."
GDPR is a big hubbabaloo about Gov't requirements to protect data. Read about that HERE and grab the free resources
Adding Cyber, Tech E&O to your insurance is easy. Getting sued by your own customer because you let a hacker into them, through you, is hard.