Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A ransom demand is only one possible cost of a cyberattack—and paying it is not the same as restoring systems or preventing data from being disclosed. The wider bill can include investigation, rebuilding, interrupted work, lost business, customer support, legal response and changes made long after services return. There is no single figure that captures every cost to an organization and everyone affected by an attack.
What does a cyberattack cost beyond the ransom?
It helps to separate three things that are often blurred together: a ransom or extortion payment, the cost of responding to an incident, and the wider consequences for the organization and the people or businesses that depend on it. An incident may involve some of these costs and not others. Even when no ransom is paid, investigation, disruption and recovery can be expensive.
IBM’s breach-cost studies provide one way to examine organizational costs. They are based on studied organizations, not a guaranteed forecast for any company. IBM says the research is conducted by Ponemon Institute and sponsored and analyzed by IBM, so its estimates should be read as study findings rather than neutral actuarial predictions.
How costs build from discovery through the aftermath
Costs can arise at several stages. Some happen at once; others become clear only after the organization has contained the attack or resumed service.
1. Ransom or extortion payment
An attacker may demand money to decrypt systems, threaten to publish stolen data, or use both tactics. Any payment is distinct from the total incident cost. Paying does not establish that systems will be restored, that stolen information will remain private, or that the organization will avoid further disruption.
#1 Best Overall
2. Investigation and containment
Organizations may need incident-response and forensic work to determine what happened, identify affected systems or data, and contain the intrusion. The effort can continue after attackers are no longer active, while the organization establishes the scope of the incident and what needs to be secured.
3. Restoration and recovery
Recovery may involve rebuilding systems, restoring data, checking that services can safely resume, and dealing with delays or dependencies between systems. “Back online” does not necessarily mean normal operations have returned: staff may still be working through backlogs or validating data and processes.
4. Disruption and lost business
Downtime can interrupt sales, orders, internal workflows, or services. Delayed work and disrupted supply chains may create costs beyond the technical restoration itself. IBM’s 2024 and 2025 summaries include lost business and operational effects among breach-cost contributors.
5. Support for customers and employees
When personal or business data is exposed, organizations may have to respond to questions and provide support. IBM’s 2024 summary identifies post-breach customer support, including help desks and credit monitoring, among cost contributors. The consequences for affected people can extend beyond the organization’s own recorded expenses.
6. Legal and regulatory response
Legal services, incident reporting and fines where applicable can add to costs. IBM’s 2024 summary identifies regulatory fines as a contributor. The obligations and potential penalties depend on the circumstances and jurisdiction; the figures discussed here do not establish a universal legal requirement or fine.
7. Commercial and reputational effects
An attack may be followed by lost revenue or share value, reputational damage, or changes in customer and business relationships. These outcomes are difficult to reduce to one comparable price. The UK government’s 2025/2026 survey reports how often respondents said they experienced some of them, not the total monetary value of those effects.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
8. Longer-term changes
After an incident, an organization may increase security spending, delay projects, or change prices. IBM’s July 2025 release says nearly half of organizations planned to raise prices after breaches. That result applies to IBM’s study population; it is not a forecast for every organization or proof that customers will face a particular increase.
Why disruption can outlast the technical response
Containment, restoration and full recovery are different milestones. An organization may stop an attacker but still need to rebuild systems, resume workflows, clear delayed work and address customer or regulatory response.
- IBM 2024: Among 604 organizations studied, 70% reported that operations were significantly or moderately disrupted. IBM reported an average global breach cost of USD 4.88 million, a 10% increase from 2023.
- IBM 2025: The global average breach cost was USD 4.44 million, down 9% from USD 4.88 million in 2024. IBM reported a mean of 241 days to identify and contain a breach, the lowest figure in nine years in its summary. The summary identifies faster containment as a factor in the cost decline.
- IBM’s July 2025 release: Nearly all organizations in the study experienced disruption. Among organizations that reported recovery, most took more than 100 days on average.
These are findings from different annual IBM reports, not a single continuous forecast for an individual incident. The reported recovery duration also applies to the organizations that reported recovery, not to every organization in the study.
What the reported averages do—and do not—tell you
IBM’s July 2026 release reports an average global breach cost of USD 4.99 million. Its study covered breaches at 602 organizations globally between March 2025 and February 2026. That is an average for the studied sample, not a likely bill for every business or a cap on possible losses.
The same release reports an average cost of USD 6 million for AI-enabled malicious breaches, roughly USD 1 million above the reported global average. IBM says one in four malicious breaches were AI-enabled, a 56% increase over the preceding year. These figures describe the report’s studied cases; they do not show that every AI-related incident costs that much, or that AI involvement alone explains an incident’s cost.
IBM’s 2025 release gives USD 5.08 million as the average cost of an extortion or ransomware incident when disclosed by an attacker. This is an incident-cost figure—not the average ransom demanded or paid.
Best Value
Before comparing any cost statistic, check its geography, population, cost definition, statistic and time window. An average, a median, a high-percentile figure and the share of organizations reporting an outcome answer different questions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the UK survey’s median looks so different
The UK Department for Science, Innovation and Technology’s Cyber security breaches survey 2025/2026 measures respondents’ perceived cost of their most disruptive breach or attack. It is not the same measure as IBM’s modeled global average breach cost.
- Incidence: 43% of UK businesses and 28% of UK charities said they had observed a cyber security breach or attack in the preceding 12 months. The survey extrapolated those estimates to approximately 612,000 businesses and 57,000 charities.
- Median perceived cost: The median was £0 for businesses and charities overall; it was £30 for medium and large businesses.
- High-cost tail: The 95th-percentile perceived cost was £4,000 for businesses and £10,000 for medium and large businesses. The survey says most respondents did not experience high costs, while a minority could face high costs.
- Reported commercial effects: 5% of businesses reported loss of revenue or share value following a breach or attack, up from 2% in the 2024/2025 survey. 3% reported reputational damage, up from 1%.
A £0 median does not mean that all incidents were cost-free: a median describes the midpoint of the reported distribution, while the 95th-percentile figures show a higher-cost tail. Nor should these pound-denominated perceived-cost figures be directly compared with IBM’s global modeled averages as if the methods and populations were the same. The UK survey also cautions that its overall-incidence measure cannot be compared with years before changes to its wording.
How to estimate the exposure for your organization
Published averages can put a breach in context, but planning is more useful when it starts with the services and dependencies your organization actually relies on. Use these questions to identify cost categories that a simple ransom estimate would miss:
- What could stop? Identify critical services, workflows, locations and suppliers, and consider how disruption to one could affect the others.
- What data or customers could be affected? Consider what information the organization holds and what support or response could be needed if it were exposed.
- How long could restoration take? Distinguish containment from restoring systems, validating them and returning work to normal.
- Which costs are included in your estimate? Separate a possible payment from investigation, restoration, interruption, support, legal response and longer-term changes.
- What does insurance cover? Treat coverage as a policy-specific planning question; the studies cited here do not establish what any particular policy will pay.
Why there is no single “true cost” total
Organizational studies capture defined costs for particular samples and periods. They do not add up every consequence for customers, employees, suppliers, public services and other downstream organizations into one comprehensive global figure. A useful cost estimate therefore needs a clear boundary: whose costs it counts, which incident effects it includes, and whether it reports an average, median, percentile or individual outcome.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
