Blog Post
The Cost of a Mid-Market Ransomware Attack
October 14, 2026
The extortion demand is the figure that gets quoted and rarely the largest line. Downtime, restoration, forensics, legal hours and notification each contribute, and for a mid-market company the regulatory components behave in a way that catches finance teams out.
Reporting deadlines do not scale with headcount. A three-hundred-person company and a thirty-thousand-person company face the same clocks, measured from the same triggers, which makes the compliance share of a mid-market loss closer to flat than proportional.
What Are the Parts?
Six, and they accrue on different schedules rather than arriving together.
- Business interruption: Revenue not earned while operations are degraded, accruing from the first hour onward.
- Restoration: Rebuilding systems and validating data, which continues after operations formally resume.
- Forensics: Establishing what was accessed, which every subsequent determination depends on.
The Other Three
Legal hours, which multiply with the number of concurrent obligations rather than with the size of the breach. Notification, which scales with record count and jurisdiction. The extortion payment itself completes the set, where one is made.
Which Dominates
Interruption, in most modelled scenarios, since it compounds for every hour operations stay down while the other lines are largely fixed per event. Modeling the loss as downtime rather than data sets out why the duration term carries the figure.
Why Does Payment Start a Clock Rather Than End One?
Because paying is itself a reportable event in some regimes, and it closes none of the obligations the incident already triggered.
The Payment Clock
Under the Cyber Incident Reporting for Critical Infrastructure Act, a covered entity making a ransom payment must report it no later than 24 hours after the ransom payment has been disbursed. The window is shorter than the seventy-two hours the same statute allows for the underlying incident, and it applies whether or not the incident met the substantial threshold on its own.
The Securities Position
The Securities and Exchange Commission addressed this directly. Where a registrant pays and the threat actor ends the disruption or returns the data before any materiality determination, the cessation or apparent cessation of the incident does not remove the obligation, so the determination still has to be made and a material incident still has to be disclosed.
The Planning Consequence
Payment removes an operational problem and adds a reporting one. Any incident plan treating payment as the resolution has mis-sequenced the work that follows it.
Why Do the Clocks Cost More Than They Look?
Because they start from different triggers, so one event produces several deadlines that do not align.
Different Starting Points
Data protection notification runs within 72 hours of becoming aware of it. Securities disclosure runs from the materiality determination rather than from discovery. Payment reporting runs from disbursement. Health breach notification runs from discovery. The same incident therefore starts four counters at four moments.
The Determination Is Itself a Deliverable
A materiality assessment has to be made without unreasonable delay and documented well enough to defend afterward, which is legal and financial work performed while systems are still down. Reaching a materiality determination under pressure is where mid-market teams find they have no process.
Why Headcount Makes It Worse
A large organization runs these tracks in parallel with separate teams. A mid-market company typically has one general counsel and one external firm, so the tracks run sequentially and the billable hours stack rather than overlap.
What Scales and What Does Not?
Two of the six lines scale with the organization and four do not, which inverts the usual assumption that a smaller company faces a smaller event.
Scales With Size
Interruption, since lost revenue is proportional to revenue earned. Notification also scales, since cost per record multiplied by record count rises with the customer base.
Close to Fixed
Forensics, legal hours, restoration labor and the determinations each regime requires. An incident response retainer, a forensic engagement and a materiality assessment cost broadly what they cost, whoever is buying them.
Which Changes the Ratio
Fixed components form a far larger share of a mid-market loss than of an enterprise one. The absolute figure is smaller and the proportion of revenue is frequently larger, which is the finding that belongs in front of a board.
What Should Be Established?
Three figures, and two come from outside security.
Revenue Per Hour of Operations
The interruption line is duration multiplied by this number, so a recovery time objective converts into currency the moment it exists. Finance holds the figure already.
Which Regimes Apply
Sector, jurisdictions of data subjects and listing status between them determine how many counters start. An organization that cannot list them before an incident will be discovering them during one.
The Record Count
Notification cost is population multiplied by per-record cost, and the population is knowable today. Cyber risk quantification combines the three into a distribution rather than a point estimate, and the method behind it is documented rather than asserted.
The Demand Is Not the Loss
Six components make up a ransomware loss and the extortion figure is rarely the largest, with interruption dominating because it compounds hourly while the others are largely fixed per event. Payment starts obligations rather than ending them, since a covered entity reporting under the critical infrastructure statute has twenty-four hours from disbursement, a shorter window than the seventy-two hours for the incident itself, and the Securities and Exchange Commission has stated that cessation following a payment does not remove the duty to determine materiality and disclose. The clocks run from four different triggers, so one event produces counters that never align, and the materiality determination is itself work performed while systems are down. Fixed costs form a larger share of a mid-market loss than an enterprise one. Ransomware exposure modelled as a distribution shows that spread.
To see a ransomware scenario priced across all six components, book a demo with our cyber risk experts.
Ransomware Cost FAQs
Speak to an ExpertWhat are the components of a ransomware attack cost?
Does paying a ransom end the reporting obligation?
Why do ransomware reporting clocks start at different times?
Why is ransomware proportionally more expensive for a mid-market company?
Which ransomware cost component is usually largest?
What figures should a company establish before a ransomware incident?
