Cyber Security is often treated as an IT responsibility. The conversation centres on firewalls, software updates, passwords and multi-factor authentication, but when ransomware disrupts a business, the consequences reach far beyond the IT department.
Customers still need support. Staff still need to do their jobs. Orders, invoices and payments still need processing. If the systems behind those activities become unavailable, the financial impact can build quickly, as One2Call's own Gabriel Williams has experienced first hand:
"In a previous role I worked with a business that was hit by ransomware and couldn't trade properly for a week. The disruption alone cost them around £250,000 in lost business, and they then paid a further £50,000 to £100,000 to recover their systems and make sure the attackers were fully removed. It's a good example of why ransomware isn't just an IT problem. The financial impact can be significant across the whole business."
Here are five ways ransomware can affect your business financially.
1) Lost revenue and disrupted cashflow
Ransomware can prevent staff from accessing the systems they need to keep the business running.
That could mean:
- Missed orders and delayed deliveries
- Invoices that cannot be raised
- Delays in collecting payments
- Reduced service levels and missed customer commitments
- Slower work and more mistakes as staff switch to manual processes
Following the 2024 ransomware attack on CDK Global, many dealerships lost access to the systems used to manage sales, financing and customer transactions. While staff could often continue operating in a limited way, completing deals became slower and more complex. This meant revenue was delayed, payments took longer to process and normal cashflow was disrupted until systems were restored. [blackfog.com], [decipheru.com]
Even if the business can continue operating, it may be working at a fraction of its normal capacity, and cashflow can be impacted quickly.
For example:
- a business normally processes £10,000 worth of orders each working day
- a cyber attack means systems are unavailable for two days
- manual workarounds allow it to process only 25% of its usual order value.
That leaves £15,000 worth of orders delayed or potentially lost. Some orders may be fulfilled later, while others may be cancelled.
The £15,000 is not automatically a permanent revenue loss, but it could be, and it does not include recovery costs, extra staff time or post-event security hardening.
The same distinction applies to invoicing. An invoice delayed by two days may still be paid, but the delay can put pressure on cashflow.
For Finance Managers thinking about the potential impacts of cyber crime, two useful questions to ask are:
- “What would one day of disruption mean for our business?”
- “Which systems do we depend on to process orders, raise invoices and collect payments?”
The answers help turn Cyber Security into a practical business discussion.
2) Recovery costs
Getting systems working again can involve several different costs.
These may include:
- Specialist support to contain the incident
- Investigations into how the attack happened and what was affected
- Rebuilding devices and restoring systems
- Checking backups are usable and safe to restore
- Temporary systems, overtime and additional support
- Security improvements to address the weaknesses identified
For example:
MGM Resorts estimated that a 2023 cyberattack cost the business around $100 million through operational disruption, alongside millions more in incident response and recovery expenses. The cost of getting back to normal can often exceed the immediate technical work. [infosecuri...gazine.com], [therecord.media]
Having backups is important, but restoring data is only one part of recovery. Devices, user accounts and connected systems may also need checking before normal work can resume.
Being back online does not necessarily mean being back to normal. Staff may still be dealing with backlogs, checking records and catching up on delayed work.
Those costs should be considered alongside the technical recovery bill.
3) Regulatory and legal costs
A ransomware attack can also create data protection obligations if personal data is affected.
This can include personal data being accessed, stolen, destroyed or made unavailable. Data does not have to be stolen for an incident to qualify as a personal data breach.
Under UK GDPR, organisations must assess the risk to individuals. A breach must be reported to the Information Commissioner’s Office without undue delay and within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to people’s rights and freedoms.
Depending on the circumstances, affected individuals may also need to be informed.
The financial impact can include:
- Legal and specialist advice
- Time spent investigating and documenting the breach
- Preparing notifications and responding to enquiries
- Management time diverted from normal responsibilities
- Potential regulatory action, including fines where appropriate
For example:
Following its 2023 ransomware attack, Capita faced recovery costs exceeding £25 million as well as regulatory scrutiny over how personal data had been protected, demonstrating how the financial impact can continue long after systems are restored. [cyberbreaches.org], [theregister.com]
A ransomware attack does not automatically result in a fine. The circumstances of the incident and the organisation’s compliance matter.
Reporting obligations depend on the details and risks involved. Businesses should seek appropriate advice for their situation.
4) Insurance costs and cover
Cyber insurance may help with some incident costs, depending on the policy and its conditions. However, businesses should understand what their cover includes before an incident happens.
After an attack, future cover may be affected. Depending on the insurer and the circumstances, this could mean:
- Higher premiums
- Higher excesses
- Changes to exclusions or cover limits
- Additional security requirements
- Fewer available insurance options
For example:
Following a sharp rise in ransomware claims between 2019 and 2023, cyber insurers increased scrutiny of applicants and introduced tougher requirements around controls such as multi-factor authentication, endpoint protection, backup testing and incident response planning. Businesses with weaker controls may face higher premiums, larger excesses or reduced coverage following an incident. [infosecuri...gazine.com], [csoonline.com]
The financial impact may therefore continue beyond the immediate recovery period. Businesses should review their policy requirements and check that the security measures they have declared are in place.
5) Damage to customer trust
The effect on reputation can also have a financial cost.
Customers may question whether your business can protect their information or continue delivering its services. Prospective customers may ask more detailed security questions before signing a contract.
An incident could lead to:
- Customers moving to another supplier
- Longer sales and procurement processes
- Additional checks from partners
- More time spent reassuring customers
- Lost opportunities where confidence has been affected
For instance:
Following the 2023 cyberattack on MGM Resorts, customers experienced disruption to booking systems and guest services, while the company reported lower occupancy than the comparable period in the previous year. When customers lose confidence in a supplier's ability to operate reliably, the financial impact can continue long after systems have been restored. [therecord.media], [csoonline.com]
Clear, accurate communication matters during recovery. Customers need to understand how the disruption affects them and what you are doing to resolve it.
Rebuilding that confidence can take longer than restoring the systems themselves.
What should businesses do next?
Ransomware can affect revenue, cashflow, recovery budgets, insurance and customer relationships. It needs attention from the people responsible for running the business as well as those responsible for its technology.
Start by identifying:
- Which systems are essential to daily operations
- What disruption would cost
- How staff would work while systems are unavailable
- Whether backups have been tested
- Who would coordinate the response and keep customers informed
To discuss your business’s Cyber Security and resilience planning, reach out to us and we'll be more than happy to help.
Ready for a chat?
Our expert consultants are ready to help.
Let's spend 15 minutes exploring your business challenges and how we can help.
Let's spend 15 minutes exploring your business challenges and how we can help.
