My initial reaction is simply that a lot of small businesses know their customers personally. I think that makes a huge difference in terms of making sure they are protecting the people they know. This is their livelihood.
As you grow as a company, you may lose a bit of that. Therefore systems have to be put into place, and those sorts of potentials for abuse can happen. I think that's a big part of why you don't see breaches among smaller firms, because they're more aware of making sure they are protecting the people they know and rely on.