What a ransomware attack really costs a small business

Downtime is the biggest line

Start with what one day without systems costs you. A ten-person accounting practice that cannot open client files still pays wages, rent and leases, while billable hours stop. A distributor that cannot see stock or print picking slips stops shipping. Multiply the daily figure by a realistic recovery time, which for an unprepared business is often one to three weeks rather than one or two days. Recovery is rarely a clean switch back to normal. Systems come back in stages, staff work around missing data, and some work has to be redone from paper or memory. Productivity can stay below normal for a month after the systems are technically restored.

Recovery and investigation labour

Someone has to work out how the attacker got in, what they touched and whether they are still there. Incident response specialists charge by the hour, and a proper investigation of a small network can take days. Rebuilding servers, reimaging every computer, resetting every password and restoring data is a separate block of work on top. In New Zealand these combined bills commonly run from the low tens of thousands of dollars for a small, well-backed-up office to well into six figures where backups failed or data had to be reconstructed. The range is wide because it depends almost entirely on how prepared you were.

Data theft and the Privacy Act

Most ransomware groups now copy data before encrypting it, then threaten to publish it. That turns a technical problem into a privacy one. Under the Privacy Act 2020, if a breach of personal information is likely to cause serious harm, you must notify the Office of the Privacy Commissioner and the affected people as soon as practicable. That means legal advice, working out exactly whose information was taken, drafting notices and handling calls from worried customers or staff. A business holding health, financial or identity documents faces a heavier workload and more scrutiny.

The costs that do not show on an invoice

Customers who could not get service may move to a competitor and not come back. Tenders can ask whether you have had a cyber incident. Staff morale takes a hit when people work late for weeks rebuilding records. Banks and partners may ask questions or tighten terms. None of these appear on the incident response bill, but they are real.

There is also the question of paying. A ransom does not buy certainty: decryption tools can be slow or broken, stolen data may still be leaked or sold, and paying marks you as a business that pays. Government guidance in New Zealand discourages payment, and some payments can raise legal issues of their own.

Where insurance fits

A cyber insurance policy can cover investigation, recovery, legal advice, notification and some business interruption. It will not cover everything, it carries an excess, and insurers increasingly decline or limit claims where the controls you declared on the application were not actually in place. Read the policy for waiting periods on business interruption and for any exclusions around unpatched systems.

Turning the number into a decision

Once you have a rough daily downtime figure and an idea of recovery costs, compare it with the annual cost of the controls that would shorten or prevent an incident: tested immutable backups, EDR, MFA and patching. For most offices the prevention budget is a small fraction of a single bad week. The figure also tells you how fast recovery needs to be, which is the right starting point for choosing a backup design.

A worked example

Picture a twelve-person engineering consultancy. Wages, rent and leases cost around eight thousand dollars a day, and the team bills a little more than that when work is flowing. Ransomware encrypts the file server and every laptop on a Monday. The backups were on a USB drive attached to the server, so they are gone too. It takes nine working days to rebuild systems and recover what can be found in email attachments and OneDrive, and another fortnight before the team is working at full speed. The firm also pays for an investigation, a rebuild, a lawyer and a temporary contractor to re-enter project data.

Even before counting any lost clients, the bill for that fortnight comfortably exceeds what the firm would have spent over several years on immutable backups and monitored endpoint protection. The same attack against an office with a tested, separate backup typically becomes a two or three day interruption, an investigation and a lesson, rather than a crisis. The figures here are illustrative and every business differs, but the shape of the comparison holds for most small offices.