Fix grammar and sentence structure.

To me, this paragraph is about the actual direct financial cost of not being PCI compliant. 1. direct financial penalties/fines (Heartland example), 2. Financial loss due to customer perception (Target example). 3. Financial loss due to the Report on Compliance audits (I did spend some time looking for a cite for that, it could use one).

It doesn't seem that "Small companies are equally at risk, accounting for 80% of all instances of unauthorized access" is talking about the amount of financial hardship one organization can suffer (like the above 3 statements). It is more talking about the risk of having a breach, not the financial troubles you could be in once a breach occurs.

I do think that citation is important. Perhaps in the executive summary or in another section discussing the breadth of the problem. That cite points to the level of risk involved and the motivation for both the PCI and individual merchants.