Revenue
A ransomware attack can severely affect the operating capability of an organization. Even if the organization is well prepared and has functional back-ups, restoring affected systems could take hours. Worse, organizations that were not as prepared, or whose back-ups may have been compromised during the attack, could take days or weeks to return to full operating capacity, meaning their revenues will decline or stop all together while they are recovering
Reputation
Suffering a data breach or a ransomware attack can adversely affect the reputation of an organization. Some customers may view a successful attack as an indication of weak security practices, or may be so severely impacted by a service disruption they choose to conduct business elsewhere
Financial
Ransomware is an unexpected cost and it is expensive. In addition to the loss in revenue an organization may suffer, there are other costs that may be obvious and some that are not. More obvious costs include: the cost of the ransom payment (if paid); the cost to remediate the incident, to include new hardware, software, and incident response services; insurance deductibles; attorney fees and litigation; and public relations. Other less obvious costs may include: insurance premium increases; devaluation of reputation/tradename; and loss of intellectual property
Data
During a ransomware attack, a malicious actor will encrypt numerous files making them, and often the systems that rely on them, unusable. If a ransom is not paid these encrypted files are often permanently locked requiring the organization to regenerate the information, if it can.However, even if a ransom is paid, there is no guarantee that a threat actor will act benevolently and provide a decryption key.Moreover, even if a key is provided it is still possible the ransomware attack caused significant destructive damage, which may require rebuilding the affected systems anyway. Further, if threat actor has stolen a trade secret, propriety information, or any Personally Identifiable Information (PII), the loss of this data could spur legal action or lead to the loss of a competitive advantage.
