The number of security measures in place and the capabilities to discover breaches will vary widely from company to company and depends on the type of data that is stolen.
There are several ways a company will learn of a breach:
- security sofware catches unusal behaviour and marks it for later review (or stops it on the fly after part of the data already left the network)
- while routinely auditing logs (e.g. of a webserver) the company spots a potential attack vector and confirms it
- the company receives a note by an insider (e.g. from a bank if payment data was involved and is now misused)
- the attackers contact the company themself (e.g. to extort money)
- the users/customers alert the company (e.g. complains about spam that was sent to related email adresses that were stolen)
- news, reporters or other individuals get their hands on the stolen data and report it publicly or in private
Since the number of attackers and their motives to steal data from companies as well as the way they use the data in the end differs from breach to breach it is totally possible that small (and even larger) companies never know that their data has been stolen.
If the attackers don't use or publish the stolen data it will be hard to recognize if you do not have the security routines and tools in place to catch such a breach.
There will also be cases where the origin of a breach cannot be tracked back easily. Especially if a small number of stolen data is merged with larger parts (e.g. some 50 customer email addresses used in a huge spam campaign with millions of other recipients)