How Much Does a Ransomware Incident Cost a Small Business?
The ransom is only one line. Downtime, forensics, restoration, legal review, notification and lost sales can make a no-ransom incident expensive.
- The ransom is not the cost model. Downtime and restoration usually dominate the small-business loss.
- A no-payment incident can still create forensics, legal, notification and lost-sales bills.
- Estimate cost by day offline and systems rebuilt, not by the attacker’s demand.
Ransomware is an operational shutdown with a security investigation attached. Revenue stops, employees improvise, vendors wait and every restored system must be trusted again. A payment, if made, does not remove those tasks.
The eight bills
| Cost | How to estimate |
|---|---|
| Business interruption | Gross margin lost per day × downtime |
| Idle and recovery labor | Hours × loaded employee rate |
| Incident response | Forensics, containment and counsel |
| Restoration | Devices, servers and cloud accounts rebuilt |
| Notification | Affected records, mail and support |
| Customer loss | Churn and delayed sales |
| Insurance impact | Deductible and renewal change |
| Extortion payment | Demand plus negotiation and transaction cost |
Calculate downtime first
A company producing $50,000 of monthly gross margin loses roughly $2,500 per business day. Ten days offline is $25,000 before outside responders or replacement hardware. Include delayed invoicing and overtime after systems return.
Recovery is not file restoration
Teams must identify entry, remove persistence, reset identities, rebuild endpoints, validate backups and monitor for recurrence. Restoring encrypted data onto a still-compromised identity system can restart the incident.
Data theft creates a second incident
Modern extortion often combines encryption with data theft. Even a clean backup does not answer notification duties, customer contracts or leaked credentials. Legal counsel and forensics determine what data left and which deadlines apply.
The decision
Model a ransomware loss as at least ten business days of interruption plus external response and complete rebuild costs. Use that number to justify isolated backups, managed detection, MFA and a practiced incident plan before discussing a possible ransom.