Beyond the breach: The hidden costs of a cyber attack

Research for Gallagher and the Centre for Economics and Business Research reinforces the point. Its severe-outcome model for large UK businesses placed disrupted trading at £5.4 billion, compared with £226 million for external forensic, consultancy and technical support. The model also identified substantial litigation, intellectual property and reputational costs.

These are modelled estimates rather than recorded market totals, but they provide a useful illustration of where cyber losses can accumulate.

What is silent cyber insurance?

The insurance consequences become more complex where no dedicated cyber policy has been purchased.

"Silent cyber" refers to cyber exposure within a traditional insurance policy that does not clearly include or exclude the peril. Depending on the policy wording and circumstances, a cyber event may trigger cover under several policies, expose an unintended gap, or do both.

This issue is particularly relevant to third-party data breach claims. An organisation may face allegations that it failed to protect personal information, respond appropriately or comply with its duties as a controller or processor. Such claims may include compensation for financial loss, distress or other damage, alongside defence costs.

A traditional liability policy may cover part of the resulting claim, depending on its wording. It may not, however, cover the organisation’s own investigation, restoration, business interruption, notification or crisis-management costs.

This fragmentation creates a practical challenge. A business may have insurance for the claim that eventually arrives, while having little or no support available for the incident-response activity needed in the immediate aftermath of an attack.

The latest government survey found that 47% of UK businesses believed they had some form of cyber insurance, yet only 10% reported having a specific cyber policy. A further 22% were unsure whether any cyber cover existed within their insurance arrangements.

Dedicated cyber insurance is not simply an indemnity product. Depending on the policy wording, it may provide access to incident-response specialists, legal advisers, forensic investigators, notification services and system-recovery support.

These resources can be particularly valuable in the first hours of an incident, when decisions made under significant pressure may influence both the scale of the loss and the organisation's regulatory position.

How can data breach claims develop after systems are restored?

From a claims perspective, data breach losses do not necessarily crystallise when the network is restored. They can develop as the affected data is identified, individuals are notified and allegations begin to emerge.

Claim assessment is rarely determined by the number of records alone. The nature and sensitivity of the information, evidence of access or misuse, the organisation’s security measures, the promptness of its response and the actual effect on individuals are all important. These factors may influence the value of any claim where liability is established.

Most data breach cases involve relatively modest awards where recoverable damage is established. However, where exposed data involves hundreds of thousands of data subjects, even modest individual awards can aggregate into significant overall settlements, potentially testing policy limits.

Against that backdrop, the legal landscape continues to evolve.

In Farley v Paymaster, the Supreme Court heard the appeal on 7 and 8 October 2026 concerning, among other matters, whether the relevant legislation requires a threshold of seriousness. Judgment is currently awaited.

The practical lesson is to avoid both extremes. Every notification does not automatically establish a compensable claim. Equally, apparently modest incidents should not be dismissed before the information involved, potential harm and supporting evidence have been properly assessed.

How can cyber regulation increase the financial impact of an attack?

UK organisations must notify the Information Commissioner’s Office of a qualifying personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to create a high risk to data subjects, those individuals must also be informed without undue delay. All personal data breaches must be documented whether they are reportable, or not.

That timetable places immediate pressure on management, legal, compliance and technology teams. An organisation may still be determining what happened while simultaneously deciding whom to notify, what to say and how to avoid causing unnecessary alarm.

Regulatory scrutiny cannot be ignored. In October 2025, the Information Commissioner’s Office fined Capita a combined £14 million following a breach in which the personal information of 6.6 million people was stolen. The regulator found that Capita had failed to ensure the security of personal data and lacked appropriate technical and organisational measures to respond effectively. It also reported that 325 organisations supported by Capita were affected, demonstrating how a supplier incident can spread across multiple customers.

If enacted in its proposed form, the Cyber Security and Resilience Bill would further expand the UK’s resilience regime to include areas such as managed service providers, data centres and designated critical suppliers.

The direction of travel is clear: organisations need to understand their critical dependencies, maintain effective controls and test their response arrangements.

How can a cyber-attack affect reputation and customer trust?

Operational disruption can be measured in hours or lost sales. Damage to trust is harder to quantify and may compound over time.

Customer attrition, increased acquisition costs and stricter procurement scrutiny can continue long after systems have been restored. The effect may appear through customer cancellations, reduced spending, unsuccessful tenders, employee departures, investor reaction or additional contractual scrutiny.

The 2025/2026 Cyber Security Breaches Survey recorded increases in businesses reporting loss of revenue or share value following incidents, from 2% to 5%, and reputational damage, from 1% to 3%. The survey also warns that it captures only attacks that organisations detected and were willing to report.

Taken together, these issues demonstrate that cyber losses are rarely confined to technology. They can become wider business resilience events requiring coordinated operational, legal and financial responses.

Why is cyber resilience the real measure of protection?

The true cost of a cyber-attack is not simply the ransom demand, forensic invoice or immediate interruption. It is the combined effect on operations, employees, customers, suppliers, regulators, litigation, reputation and future commercial confidence.

Insurance can transfer part of that risk, but only where coverage has been deliberately designed, understood and tested. Silent cyber may provide a route to indemnity in some circumstances, but it is not a substitute for a coherent cyber programme or a rehearsed response.

For boards, risk managers and business leaders, the opportunity is to move the conversation beyond whether an organisation "has cyber cover".

Instead, consider:

• What could stop the business from operating?
• Who else would be affected?
• Which costs could emerge later?
• Where might insurance coverage gaps exist?
• How quickly could the organisation recover with trust intact?

Cyber resilience is not measured solely by whether an attack is prevented. It is also measured by whether the business understands its dependencies, contains the consequences and recovers without losing the confidence of customers, employees and partners.

Research for Gallagher and the Centre for Economics and Business Research reinforces the point. Its severe-outcome model for large UK businesses placed disrupted trading at £5.4 billion, compared with £226 million for external forensic, consultancy and technical support. The model also identified substantial litigation, intellectual-property and reputational costs. These are modelled estimates rather than recorded market totals, but they provide a useful illustration of where loss can accumulate.

Silent cyber: Hidden cover, but with limitations

The insurance consequences become more complex where no dedicated cyber policy has been purchased.

"Silent cyber" refers to cyber exposure within a traditional insurance policy that does not clearly include or exclude the peril. Depending on the policy wording and circumstances, a cyber event may trigger cover under several policies, expose an unintended gap, or do both.

This issue is particularly relevant to third-party data breach claims. An organisation may face allegations that it failed to protect personal information, respond appropriately, or comply with its duties as a controller or processor. Such claims may include compensation for financial loss, distress, or other damage, alongside defence costs.

A traditional liability policy may cover part of the resulting claim, depending on its wording. It may not, however, cover the organisation’s own investigation, restoration, interruption, notification or crisis-management costs.

This fragmentation creates a practical challenge. A business may have insurance for the claim that eventually arrives, while having little or no support available for the incident response activities required in the immediate aftermath of the attack.

The latest government survey found that 47% of UK businesses believed they had some form of cyber insurance, yet only 10% reported having a specific cyber policy. A further 22% were unsure whether any cyber cover existed within their insurance arrangements.

Dedicated cyber insurance is not simply an indemnity product. Depending on the policy wording, it may provide access to incident response specialists, legal advisers, forensic investigators, notification services and system recovery support. Such resources can be particularly valuable in the first hours of an incident, when decisions made under significant pressure may influence both the scale of the loss and the organisation's regulatory position.

Third-party liability can develop long after recovery

From a claims perspective, data breach losses do not necessarily crystallise when the network is restored. They develop as the affected data is identified, individuals are notified and allegations begin to emerge.

Claim assessment is rarely determined by the number of records alone. The nature and sensitivity of the information, evidence of access or misuse, the organisation’s security measures, the promptness of its response and the actual effect on individuals are all important and may influence the value of any claim where liability is established.

The majority of data breach cases involve relatively modest awards where recoverable damage is established. However, where the exposed data involves hundreds of thousands of data subjects, seemingly modest individual awards (£250-£1,000) can aggregate into seven or eight figure settlements overall, potentially testing policy limits. Against that backdrop, the legal landscape continues to evolve.

In Farley v Paymaster, the Supreme Court heard the appeal on 7 and 8 October 2026 concerning, among other matters, whether the relevant legislation requires a threshold of seriousness. Pending judgment, organisations and insurers must continue to manage a developing area of law rather than treat the present position as settled.

The practical lesson is to avoid both extremes. Every notification does not automatically establish a compensable claim.  Equally, apparently modest incidents should not be dismissed before the information involved, potential harm and supporting evidence have been properly assessed.

Regulation turns response speed into financial risk

UK organisations must notify the Information Commissioner’s Office of a qualifying personal data breach without undue delay and, where feasible, within 72 hours of awareness. Where a breach is likely to create a high risk to data subjects, those individuals must also be informed without undue delay. All personal data breaches must be documented, whether or not they are reportable.

That timetable places immediate pressure on management, legal, compliance and technology teams. The organisation may still be determining what happened while simultaneously deciding whom to notify, what to say and how to avoid causing unnecessary alarm.

Regulatory scrutiny cannot be ignored. In October 2025, the Information Commissioner’s Office fined Capita £14 million following a breach affecting 6.6 million people. The regulator identified deficiencies in security controls, risk assessment and response to alerts.  It also noted that 325 organisations supported by Capita were affected, demonstrating how a supplier incident can spread across multiple customers.

If enacted in its proposed form, the Cyber Security and Resilience Bill would further expand the UK’s resilience regime to include areas such as managed service providers, data centres and designated critical suppliers. Its proposals include broader incident reporting, with initial notification within 24 hours and a fuller report within 72 hours, for entities in scope.

The regulatory expectation is increasingly explicit: organisations should understand critical dependencies, maintain effective controls and test their response arrangements.

Reputation is a financial asset

Operational disruption can be measured in hours or lost sales. Damage to trust is harder to quantify and may compound over time. Customer attrition, increased acquisition costs and stricter procurement scrutiny can continue long after systems have been restored. It may appear through customer cancellations, reduced spending, unsuccessful tenders, employee departures, investor reaction or additional contractual scrutiny.

The 2025/2026 Cyber Security Breaches Survey recorded increases in businesses reporting loss of revenue or share value following incidents, from 2% to 5%, and reputational damage, from 1% to 3%. The survey also warns that it captures only attacks that organisations detected and were willing to report.

Taken together, these issues demonstrate that cyber losses are rarely confined to technology alone; they become business resilience events that require coordinated operational, legal and financial responses.

Resilience is the real measure of protection

The true cost of a cyber attack is not the ransom demand, the forensic invoice or even the immediate interruption. It is the combined effect on operations, employees, customers, suppliers, regulators, litigation, reputation and future commercial confidence.

Insurance can transfer part of that risk, but only where coverage has been deliberately designed, understood and tested. Silent cyber may provide a route to indemnity in some circumstances; it is not a substitute for a coherent cyber programme or a rehearsed response.

For boards, risk managers and business leaders, the opportunity is to move the conversation beyond whether an organisation “has cyber cover”. The better questions are: What could stop the business from operating? Who else would be affected? Which costs would emerge later? And how quickly could the organisation recover with trust intact?

Cyber resilience is not measured solely by whether an attack is prevented. It is measured by whether the business understands its dependencies, contains the consequences and recovers without losing the confidence of customers, employees and partners.

Bethany Foster, Senior Claims Technician
Steven McGhee, Head of Specialist Casualty Claims
October 2026