Cost of a Cyber Incident Statistics: Downtime, Recovery Spend and Sector Losses

Average breach cost figures say little about what an incident does to operations: how long systems stay down, what recovery costs, and how losses spread to customers and suppliers. This page collects downtime and recovery cost figures from sources other than the IBM Cost of a Data Breach Report: Sophos's State of Ransomware survey and its sector editions, Coalition's insurance claims data, the UK Cyber Monitoring Centre's event estimates, Splunk's research on downtime across the Global 2000, and losses disclosed by a listed company in its regulatory filings. Every figure carries its source, publisher and data year in the same sentence or table row. It is for CISOs, risk managers, finance and resilience teams building business impact analyses, recovery budgets and board papers. For the headline breach cost averages see the IBM Cost of a Data Breach Report and the Data Breach Statistics Guide. Last reviewed: November 2026.

Source note: every figure is quoted from the named publisher's report or filing listed at the end; survey and vendor figures are single-source and labelled with their publisher. Confirm against the official text before relying on it.

Key takeaways

• Recovery from ransomware costs seven figures on average but much less at the median: Sophos's State of Ransomware 2026 puts the mean recovery cost, excluding any ransom, at $1,700,200 and the median at $375,000, so a few very expensive incidents pull the average up.
• Most organisations are back within a month, a minority are not: the same report finds 55% recovered within a week and 83% within a month, with 17% taking longer, and an average recovery time of three weeks.
• Sector matters more than the global average suggests: Sophos's 2025 sector editions range from $0.90 million mean recovery cost in higher education to $2.20 million in lower education, with retail at $1.65 million.
• Business disruption is a separate, large cost line: UnitedHealth Group reported $279 million of business disruption impact and $593 million of direct response costs from the Change Healthcare cyberattack in the first quarter of 2024 alone.
• Cyber is a major cause of downtime, not the only one: Splunk's Hidden Costs of Downtime 2026 puts unplanned downtime at $600 billion a year for the Global 2000 and attributes 32% of it to cybersecurity causes.

Headline statistics

Statistics by theme

Recovery cost by sector

Sophos publishes sector editions of its survey. The 2026 global report does not break recovery cost down by sector, so the latest sector figures are from the 2025 editions, based on a survey of 3,400 IT and security leaders in 17 countries carried out by Vanson Bourne between January and March 2025. All respondents work for organisations with 100 to 5,000 employees, so these figures do not describe the largest enterprises.

Year-on-year falls of 24% to 78% within single sectors show how sensitive survey means are to a handful of large incidents. Use the sector figure as a range indicator alongside the global median, not as a forecast. Sophos also reports, in the manufacturing edition, that only 40% of attacks on manufacturers in 2025 led to data being encrypted, down from 74%, which matters because encryption is what forces the longest outages.

Downtime and recovery time

For a business impact analysis, the useful planning number is not the average three weeks but the tail: 17% of organisations in the 2026 survey needed more than a month. The Jaguar Land Rover cyberattack in 2025 showed what a multi-week manufacturing stoppage does to a supply chain, and the Marks and Spencer cyberattack showed the cost of weeks without online ordering in retail.

Splunk's Hidden Costs of Downtime 2026 takes the wider view across all causes of unplanned outages: $600 billion a year across the Global 2000, an average $300 million a year per company, 32% of downtime driven by cybersecurity, and an average 3.4% fall in share price after a single incident. It is vendor research, attributed as such.

Insurance claims

Coalition's 2026 Cyber Claims Report covers its own policyholders, mostly smaller businesses. Claims figures show what was paid, not the full cost to the business, because retentions, uninsured losses and longer-term revenue effects fall outside the claim.

• Ransomware: the most costly claim type in 2025, average loss $269,000; dual extortion made up 70% of ransomware claims, and attacks with data theft cost more than twice as much.
• All claims: average severity $116,000, down 19%, with frequency up 3%.
• Larger policyholders: businesses with revenue over $100 million had the highest severity of any revenue band, $268,000, and about five times the claims frequency of smaller organisations.
• Funds transfer fraud: 27% of claims, average loss $141,000.

Comparing sources makes the gap visible: Coalition's average ransomware claim of $269,000 sits below even the Sophos median recovery cost of $375,000, partly because claims exclude retentions and uninsured losses and partly because the two populations differ in size. Neither figure is wrong; each answers a different question.

For the market view, premiums and UK claims data, see the Cyber Insurance Statistics Guide.

Disclosed company losses: healthcare

Listed companies disclose incident costs in regulatory filings, which makes them one of the few primary sources that separate response costs from business disruption. UnitedHealth Group's first quarter 2024 results, filed with the US Securities and Exchange Commission, reported the impact of the cyberattack on its Change Healthcare unit:

The same filing records more than $6 billion in advance funding and interest-free loans to care providers whose payments were disrupted: a cost to liquidity that never appears in an average breach cost. See the Change Healthcare breach for how the intrusion began.

Systemic events: the Cyber Monitoring Centre scale

The UK Cyber Monitoring Centre (CMC) categorises events that affect many UK organisations on a scale of one to five, based on how widespread they are and their financial impact. Its statement on the 8 September 2026 NATS flight data system failure, which it describes as an accidental software defect with no evidence of cyber activity, shows the method:

• Category: 1, the lowest, defined by a financial loss of £10 million to £100 million and a material impact on fewer than 270 UK organisations.
• Estimate: about £33 million UK impact (modelled range £24 million to £42 million) across more than 70 UK organisations; £48 million to £76 million including overseas airlines, based on 1,800 cancelled flights.
• Where the loss fell: airlines just over £24 million, airports, ground handlers and tour operators around £8 million, NATS itself less than £1 million.
• Comparison: the CMC cites the Civil Aviation Authority independent review panel's estimate of £75 million to £100 million for the August 2023 NATS flight planning failure, about £65 million of it falling on airlines.

The lesson for planners is the ratio: the organisation at the centre of the outage bore under 3% of the estimated UK cost. Downstream losses to customers and partners dominate systemic events, which is why the CMC models them. See the Third-Party Concentration Risk Guide.

What the numbers mean for defenders

Small organisations can start from the Sophos median and Coalition's claim averages, which reflect firms of their size. Large organisations should build their own model from the cost components below, using disclosed company losses and CMC estimates to test whether their severe case is severe enough. The Cyber Risk Quantification Guide covers the modelling method.

Cost components to track in your own incidents

• Response: forensics, legal, notification, external incident response and overtime.
• Recovery: rebuilds, replacement hardware, restored data and extra cloud capacity.
• Disruption: lost revenue and output for each day of outage, by business line.
• Third-party support: credits, advances or loans to customers and suppliers.
• Recoveries: insurance payments, recorded separately so gross and net cost are both visible.

The Incident Cost Tracking Template and the Business Impact Analysis Template give a structure for these lines.

Metrics

• Measured recovery time against recovery time objective in each exercise and real incident.
• Cost per day of outage for each critical service, reviewed annually.
• Share of critical services with a tested recovery in the last 12 months.
• Gap between modelled severe-case cost and insurance limit plus retention.

Common failure patterns when using incident cost statistics

• Using one average as the budget: Sophos's mean is more than four times its median. Plan for both.
• Treating survey sector figures as stable: sector means moved by up to 78% in one year in the 2025 editions.
• Reading claims as total cost: insurance losses exclude retentions, uninsured revenue loss and longer-term effects.
• Ignoring downstream loss: the CMC estimate shows most cost falls outside the affected organisation.
• Mixing cyber and all-cause downtime: Splunk's $600 billion covers every cause; only 32% is cybersecurity-driven.
• Applying mid-size survey figures to large enterprises: Sophos respondents work for organisations of 100 to 5,000 employees.

Choosing the right source

Ransom payment behaviour also varies by sector. Sophos's 2026 report finds local and state government (72%) and media, leisure and entertainment (64%) most likely to pay, and retail least likely (32%), which affects how much of an incident's cost is ransom rather than recovery.

Methodology notes and caveats

• Sophos: vendor-commissioned survey by Vanson Bourne of organisations hit by ransomware, self-reported costs; 2,158 respondents in 17 countries for 2026.
• Coalition: the insurer's own claims book for 2025, mostly small and mid-size businesses.
• Splunk: vendor research across the Global 2000, all causes of downtime.
• UnitedHealth Group: company estimates in a regulatory filing at the time of the first quarter 2024 results; later filings may update them.
• Cyber Monitoring Centre: independent modelled estimates with ranges, for UK events affecting many organisations.

Practitioner checklist

• Use a median and a severe-case figure from sources that match your sector and size.
• State publisher, report name and data year beside every figure in board papers.
• Separate response, recovery, disruption, third-party support and insurance recoveries in your cost model.
• Set recovery time objectives for the month-plus case and test them.
• Include supplier and customer losses in business impact analysis.
• Compare your severe case with insurance limits and retention each renewal.
• Record actual costs after every significant incident to replace industry figures with your own.
• Recheck Sophos, Coalition and CMC sources when new editions publish.

Standards and references

• US SEC: UnitedHealth Group first quarter 2024 results, Form 8-K exhibit 99.1
• Cyber Monitoring Centre: Statement on the NATS incident, November 2026
• Sophos: The State of Ransomware 2026
• Sophos: The State of Ransomware in Healthcare 2025
• Sophos: The State of Ransomware in Education 2025
• Coalition: 2026 Cyber Claims Report
• Splunk: The Hidden Costs of Downtime 2026
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: IBM Cost of a Data Breach Report · Ransomware Statistics Guide · Cyber Insurance Statistics Guide · Cyber Risk Quantification Guide