The Financial Consequences of Ransomware (It’s not “just IT”)

Written by Jamie Bryan | 19 Oct 2026

Cyber Security is often treated as an IT responsibility. The conversation centres on firewalls, software updates, passwords and multi-factor authentication, but when ransomware disrupts a business, the consequences reach far beyond the IT department.

Customers still need support. Staff still need to do their jobs. Orders, invoices and payments still need processing. If the systems behind those activities become unavailable, the financial impact can build quickly, as One2Call's own Gabriel Williams has experienced first hand:

"In a previous role I worked with a business that was hit by ransomware and couldn't trade properly for a week. The disruption alone cost them around £250,000 in lost business, and they then paid a further £50,000 to £100,000 to recover their systems and make sure the attackers were fully removed. It's a good example of why ransomware isn't just an IT problem. The financial impact can be significant across the whole business."

Here are five ways ransomware can affect your business financially.

1) Lost revenue and disrupted cashflow

Ransomware can prevent staff from accessing the systems they need to keep the business running.

That could mean:

Missed orders and delayed deliveries
Invoices that cannot be raised
Delays in collecting payments
Reduced service levels and missed customer commitments
Slower work and more mistakes as staff switch to manual processes

Following the 2024 ransomware attack on CDK Global, many dealerships lost access to the systems used to manage sales, financing and customer transactions. While staff could often continue operating in a limited way, completing deals became slower and more complex. This meant revenue was delayed, payments took longer to process and normal cashflow was disrupted until systems were restored. [blackfog.com], [decipheru.com]

Even if the business can continue operating, it may be working at a fraction of its normal capacity, and cashflow can be impacted quickly.

For example:

a business normally processes £10,000 worth of orders each working day
a cyber attack means systems are unavailable for two days
manual workarounds allow it to process only 25% of its usual order value.

That leaves £15,000 worth of orders delayed or potentially lost. Some orders may be fulfilled later, while others may be cancelled.

The £15,000 is not automatically a permanent revenue loss, but it could be, and it does not include recovery costs, extra staff time or post-event security hardening.

The same distinction applies to invoicing. An invoice delayed by two days may still be paid, but the delay can put pressure on cashflow.

For Finance Managers thinking about the potential impacts of cyber crime, two useful questions to ask are:

“What would one day of disruption mean for our business?”
“Which systems do we depend on to process orders, raise invoices and collect payments?”

The answers help turn Cyber Security into a practical business discussion.

2) Recovery costs

Getting systems working again can involve several different costs.

These may include:

Specialist support to contain the incident
Investigations into how the attack happened and what was affected
Rebuilding devices and restoring systems
Checking backups are usable and safe to restore
Temporary systems, overtime and additional support
Security improvements to address the weaknesses identified

For example:

MGM Resorts estimated that a 2023 cyberattack cost the business around $100 million through operational disruption, alongside millions more in incident response and recovery expenses. The cost of getting back to normal can often exceed the immediate technical work. [infosecuri...gazine.com], [therecord.media]

Having backups is important, but restoring data is only one part of recovery. Devices, user accounts and connected systems may also need checking before normal work can resume.

Being back online does not necessarily mean being back to normal. Staff may still be dealing with backlogs, checking records and catching up on delayed work.

Those costs should be considered alongside the technical recovery bill.

3) Regulatory and legal costs

A ransomware attack can also create data protection obligations if personal data is affected.

This can include personal data being accessed, stolen, destroyed or made unavailable. Data does not have to be stolen for an incident to qualify as a personal data breach.

Under UK GDPR, organisations must assess the risk to individuals. A breach must be reported to the Information Commissioner’s Office without undue delay and within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to people’s rights and freedoms.

Depending on the circumstances, affected individuals may also need to be informed.

The financial impact can include:

Legal and specialist advice
Time spent investigating and documenting the breach
Preparing notifications and responding to enquiries
Management time diverted from normal responsibilities
Potential regulatory action, including fines where appropriate

For example:

Following its 2023 ransomware attack, Capita faced recovery costs exceeding £25 million as well as regulatory scrutiny over how personal data had been protected, demonstrating how the financial impact can continue long after systems are restored. [cyberbreaches.org], [theregister.com]

A ransomware attack does not automatically result in a fine. The circumstances of the incident and the organisation’s compliance matter.

Reporting obligations depend on the details and risks involved. Businesses should seek appropriate advice for their situation.

4) Insurance costs and cover

Cyber insurance may help with some incident costs, depending on the policy and its conditions. However, businesses should understand what their cover includes before an incident happens.

After an attack, future cover may be affected. Depending on the insurer and the circumstances, this could mean:

Higher premiums
Higher excesses
Changes to exclusions or cover limits
Additional security requirements
Fewer available insurance options

For example:

Following a sharp rise in ransomware claims between 2019 and 2023, cyber insurers increased scrutiny of applicants and introduced tougher requirements around controls such as multi-factor authentication, endpoint protection, backup testing and incident response planning. Businesses with weaker controls may face higher premiums, larger excesses or reduced coverage following an incident. [infosecuri...gazine.com], [csoonline.com]

The financial impact may therefore continue beyond the immediate recovery period. Businesses should review their policy requirements and check that the security measures they have declared are in place.

5) Damage to customer trust

The effect on reputation can also have a financial cost.

Customers may question whether your business can protect their information or continue delivering its services. Prospective customers may ask more detailed security questions before signing a contract.

An incident could lead to:

Customers moving to another supplier
Longer sales and procurement processes
Additional checks from partners
More time spent reassuring customers
Lost opportunities where confidence has been affected

For instance:

Following the 2023 cyberattack on MGM Resorts, customers experienced disruption to booking systems and guest services, while the company reported lower occupancy than the comparable period in the previous year. When customers lose confidence in a supplier's ability to operate reliably, the financial impact can continue long after systems have been restored. [therecord.media], [csoonline.com]

Clear, accurate communication matters during recovery. Customers need to understand how the disruption affects them and what you are doing to resolve it.

Rebuilding that confidence can take longer than restoring the systems themselves.

What should businesses do next?

Ransomware can affect revenue, cashflow, recovery budgets, insurance and customer relationships. It needs attention from the people responsible for running the business as well as those responsible for its technology.

Start by identifying:

Which systems are essential to daily operations
What disruption would cost
How staff would work while systems are unavailable
Whether backups have been tested
Who would coordinate the response and keep customers informed

Understanding those dependencies makes it easier to prioritise security and recovery planning.

To discuss your business’s Cyber Security and resilience planning, reach out to us and we'll be more than happy to help.

View full post