The real cost of a breach.
The ransom number is the smallest part of the total. Here's what actually hits your P&L when a breach lands.
When owners think about ransomware, they think about the ransom number. That's usually the smallest line item on the total cost. The real damage comes from downtime, legal costs, notification obligations, client churn, insurance premium hikes, and — hardest to measure but often largest — lost future revenue from the reputation hit.
The total cost, itemized
- Ransom (if paid): $20K–$500K typical for small businesses.
- Forensic investigation: $25K–$150K.
- Breach counsel (legal): $15K–$100K.
- Breach notification costs (letters, credit monitoring): $1–$5 per affected individual.
- Downtime: highly variable — often the largest cost. Every day offline is every day of lost revenue.
- Regulatory fines (HIPAA, state laws): $10K–$1M+.
- Insurance premium hikes at renewal: 20–100% typical.
- Lost clients and deals in the 12 months following: often the single largest category.
Two real total-cost walkthroughs
“A 20-person accounting firm hit with ransomware on April 15 (worst possible day).”
Red flag: Ransom: $62K. Forensics + legal: $80K. Notification: $18K. Downtime: $220K. Client churn over 12 months: ~$400K. Total: ~$780K.
“A 15-person medical practice breach exposing 9,000 patient records.”
Red flag: Ransom not paid. HIPAA fine: $40K. Notification + credit monitoring: $45K. Legal: $60K. Reputation damage and patient attrition: ~$300K over 18 months. Total: ~$445K.
What this means for you
When you evaluate your cyber insurance, your security investment, or your response plan, use the real total cost — not the ransom. A $20K/year managed security program is trivial compared to a $400K breach event with uncertain recovery. That's the math.
We help quantify your exposure.
A breach-scenario exposure model for your business takes an afternoon. Useful for boards, budget conversations, and insurance renewals.
- 1Model your own breach exposure — estimate downtime, notification, and churn costs.
- 2Use the total cost, not the ransom, when budgeting security.
- 3Share the numbers with your board or leadership. Security investment makes more sense.
- 4Confirm your insurance covers the full range of categories above.
- 5Review annually — breach costs continue to rise.
Want help securing your business?
Schedule a quick security review with our team. 15 minutes, no sales pressure — walk away knowing exactly where your gaps are.
Schedule a quick security reviewKeep reading
Ransomware starts small.
Ransomware doesn't arrive with sirens. It arrives as one boring email, one click, one moment of trust — and then spreads quietly for days before the lock.
ReadTip #10 · RansomwareWhat happens when you get breached.
A realistic walkthrough of the first 30 days after a breach — the calls, the costs, the clients, and what you wish you'd done sooner.
Read