← Back to articles

The true cost of a ransomware attack, with and without BCDR

2026-09-16 | original

read original get Synology DS923+ NAS with backup software → more articles

Why This Matters

This article underscores that the ransom payment itself is a fraction of the true financial impact of a ransomware attack—downtime, recovery, legal fees, and business disruption drive the real costs, which can reach millions of dollars. This matters to businesses because it reframes ransomware defense priorities: investing in robust business continuity and disaster recovery (BCDR) strategies can be far more valuable than focusing solely on preventing or negotiating ransom payments. For consumers and the broader tech industry, it highlights how prolonged outages and compromised backups can erode trust and prolong service disruptions.

Key Takeaways

The average total cost of a ransomware incident ($5.08M) vastly exceeds the median ransom payment ($139,875), showing the ransom is only a small part of total costs.
Downtime is a major cost driver—most organizations overestimate their recovery speed, with only 35% recovering in under a day despite 60% expecting to.
Attackers increasingly target backup systems, meaning strong, tested BCDR strategies are critical to minimizing recovery costs and operational disruption.

Worth a Look

Synology DS923+ NAS with backup software — Ransomware recovery costs balloon largely due to downtime and lost/corrupted data, and a dedicated NAS device configured for automated, versioned backups is a practical BCDR building block for small and mid-sized businesses. Having offline or immutable backup snapshots stored separately from your main network can dramatically cut recovery time and reduce reliance on paying a ransom. It's a concrete, affordable step toward the resilience the article says matters more than the ransom itself.

See Synology DS923+ NAS with backup software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.

When businesses assess the impact of ransomware, the ransom payment often gets the most attention. But the ransom is only a small part of the total cost.

According to IBM's Cost of a Data Breach Report 2025, the average total cost of a ransomware incident reached $5.08 million when downtime, remediation, legal work and business disruption are considered. By comparison, the median ransom payment is $139,875, according to the 2026 Verizon Data Breach Investigations Report.

The gap highlights that the biggest ransomware costs often come after the attack, not from the ransom itself.

This piece examines where those costs come from and how a mature business continuity and disaster recovery (BCDR) strategy can help reduce them.

The ransom is only the first line on the invoice

A ransomware attack does not produce a single bill. It creates multiple costs at the same time: lost revenue while systems are down, recovery and remediation expenses, legal and compliance work and the operational disruption that continues until the business is back on its feet.

Downtime is where the bill starts to grow

The longer critical systems remain unavailable, the more expensive an incident becomes.

The Datto State of BCDR Report 2025 found that more than 60% of organizations believed they could recover from an incident in under a day, yet only 35% did.

Every additional hour of downtime means lost productivity, delayed transactions, disrupted customer service, and IT teams pulled away from normal operations to focus on recovery.

... continue reading

Explore topics: ransomware bcdr downtime ibm cost of data breach verizon dbir