Majority of small businesses lack cyber security plans, could leave consumer information vulnerable