Measuring Financial Impacts – Ep 570 

Cyberattacks are expensive—but just how expensive? This episode dives into a brand-new study that finally puts real numbers behind the financial impact of data breaches, using thousands of cyber insurance claims instead of scary headlines and wild guesses. From ransomware and business interruption to cyber insurance surprises, you’ll discover why the biggest cost isn’t always what you think. If you’ve ever wondered whether your organization is truly prepared for a breach—or just hoping insurance will magically save the day—this conversation is packed with practical insights, a few laughs, and plenty of reasons to take another look at your risk management strategy.

In this episode:

Measuring Financial Impacts – Ep 570

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Measuring Financial Impacts

We reviewed the latest edition of the Verizon DBIR in June. The Fundamentals Still Matter Says the 2026 DBIR – Ep 563 – Help Me With HIPAA

For the first time, that same group has released another report so we can look at the real financial impact of data breaches. 2026 Breach Impact Study: The Financial Costs of Data Breaches | Verizon A publication from the authors of the 2026 Data Breach Investigations Report.

They discuss right off the bat that this question has been constant – what is the financial impact of the breaches you discuss. They point out that one of the questions they’ve always gotten is, ‘What’s the financial impact of these breaches?’ The problem was the DBIR data is anonymous. That’s one of the strengths of the report, but it also means they couldn’t tie those breaches back to actual financial losses.

To come up with this kind of a research report, they partnered with an organization called CyberAcuView. It is an organization founded by the participants in the global cyber insurance market and they’re doing data collection, analysis, and intelligence based on what they get from the insurance companies.

The research team reviewed approximately 70,000 cyber insurance claims in the United States, of which roughly 38,000 have recorded losses paid out to the policyholders. Because this data is from the insurance companies, you don’t have to know who actually had the breach. The breached organizations are still anonymous and no it doesn’t match exactly to who they included in their research for the previous report but it gives us a whole new set of data that we can use to help make risk management decisions.

For this first report they included claims that cover insurable cyber incidents from January 1st, 2019, through October 31st, 2025. It’s a pretty good cross-section of different kinds of attacks and insights into all the trend information but wow there are some interesting things that we have to share.

So the DBIR told us how people break into the house. And this report tells us what it costs after they trash the place.

Why this report matters

• DBIR = likelihood
• BIS = impact
• Risk = Likelihood × Impact
• Nearly 70,000 insurance claims
• About 38,000 with actual losses
• 2019-2025 data
• Anonymous but financial data available

We have always been fans of the DBIR report because the data is very well researched and evaluated without an eye for any expected outcomes. They point out they know that’s expected of them. They aimed “to provide an objective and data-driven measure of organizational financial impacts while maintaining the academic lens and statistical rigor our readers expect”.

It gives us a new approach to our risk management calculation. Between the DBIR report that shows us the likelihood. This report helps us calculate the impact of a given data breach. As we know likelihood times impact is what is your risk. It’s a very good opportunity to evaluate with actual data, which is what we always prefer.

Sidebar: Another reason that we love these folks’ reports is that it includes humor and occasionally nerdy references. For example, they pointed out, this study comes from the desire to answer our loyal readers’ third most frequently asked questions: “Why doesn’t the DBIR provide more in-depth analysis on the financial impact of data breaches?” Of course they have a footnote and when you go down the footnote, it tells you that the other two are a tie between “Why don’t these numbers add up to 100%?” and “Did you really think that footnote was funny?”

Insurance caveats

• Insurable loss is conservative
• Doesn’t include everything
• Deductibles + policy limits
• Actual business impact often higher
• 2025 excluded because too many claims still open

One more thing we should note before we start discussing this is that the point they brought up about the understanding that the concept of insurable loss is very important to understand because it only includes the losses included in the policy. That could then make it lower because an actual economic loss of the accident would not necessarily be included in the policy. You have deductibles, coverage scopes, payout limits, all of these things. When you’re looking at these numbers I think we should consider them conservative, if not very conservative, because we know often people may have a policy as little as $50,000 and they may have one that’s $3 million.

They did point out they used a total amount of the claim plus the deductible to calculate what they could assume as the incurred loss and they left out claims that they thought would still be open. It may not show that and when they’re looking at year over year if it’s still open, they didn’t include it.

There’s actually a lot of stuff they had to take into consideration when doing these calculations and if you want to know more, that nerdy stuff, they cover it in detail. As we know when it comes to cybersecurity, the only thing that’s certain is you shouldn’t be certain.

At least these numbers will give us something that we could use to judge things by though. That’s always better than making decisions based on scary headlines – you know how we hate focusing on headlines for decision making and education.

As always we want to follow the rules so let’s get this out of the way: “You are permitted to include statistics, figures and other information from the report, provided that (a) you cite the source as “2026 Breach Impact Study” and (b) the content is not modified in any way.”

Overall Findings

Let’s talk numbers and the concept between averages and the median amount. Averages get blown out of the water if there’s a big outlier, one that’s way more or way less than the other numbers in the dataset. Therefore they use the median, which is the middle number, because it’s less likely to have some big distortion from an outlier.

Just to reiterate the point about the median they included a bit of fun to make their point. They titled the lead in section “Insert ‘impactful’ subheader here.” Yes, that is the header.

Then, of course, they have a footnote because of course you need to understand why they did this.

The footnote on the header says, “Get it? We will be talking about impact in this subsection.” That’s exactly the kind of nerd humor we’ve come to expect from these reports.

But the more interesting footnote is number 9 on the same page. After discussing why they use the median instead of the average, they explain that they intentionally did not publish the average breach cost.

“The BIS will not publish what the average is on purpose, so the amount does not get picked up by large language model aggregators and posted all around social media.”

I laughed because they’re absolutely right. How many times have we seen someone post “The average breach costs $4.8 million” with absolutely no context?

They’re trying to stop exactly that from happening. Especially now with AI picking up all of those posts and never including anything further either.

Instead, they want us looking at the distribution of losses because that’s much more useful when you’re trying to make risk management decisions. It isn’t just about asking, “What will it cost if we get hit?” It’s also asking, “What kinds of costs are most likely to have the biggest impact if we do get hit?”

That’s actually how we approach the executive reviews of our assessment reports. We base our recommendations on where you’ll get the biggest reduction in risk and the most value if a data breach happens. Sure, there are always quick wins that people want to tackle first. But if those quick wins don’t really move your exposure needle, are they actually wins?

The overall economic impacts between 2019 of $61,124 and 2024 of $110,000 is a significant increase. Just between those two time frames, there’s been a massive change in what we see on a day-to-day basis from a cybersecurity standpoint, business standpoint, everything. A dramatic period of change. This makes sense when that is also where they saw the median had, “the equivalent Consumer Price Index inflation in the United States for this time period was around 23%.” That’s real growth, not growth you want but real growth.

As we all suspected, the costs have been gradually increasing every year – sometimes bigger jumps but that change is obvious when you look over that long of a time frame.

Some Specifics

We always like to look at the SMB segment and compare it to itself, the small and medium markets, the way that they’ve broken them out:

• If it’s less than 25 million, that’s the SMBs they call it.
• Mid-market is 25 million to 250 million in revenue.

That makes it pretty easy for you to figure out what’s the large enterprise and then they compare the three different findings once they’ve broken them out.

The good news is the SMB median number for this time period, 2019 to 2024, is, as they call it, a modest $38,406. Now the high end of that is over a million and the lowest is $26,081. With those numbers you can feel somewhat good but again remember these are very conservative.

But wait before you walk away from that number. One thing that I found really interesting is that while the dollar amounts for small and medium-sized businesses are obviously lower than for large enterprises, Verizon says don’t take too much comfort in that.

Think about it this way. If a Fortune 500 company loses a million dollars, that’s painful. If a small physician practice loses $100,000, that could threaten payroll, expansion plans, or even whether they stay in business.

That’s why they looked at the losses as a percentage of the organization’s revenue instead of just looking at the dollar amount. In the worst cases, they found that cyber losses could exceed 7% of annual revenue for an SMB. That’s a huge hit for a business that doesn’t have a lot of extra cash sitting around.

That’s something we’ve talked about for years. We see people buying cyber insurance because someone told them they needed a policy, but they never really stop to ask, “If we were down for three weeks, would this actually keep our business running?”

That’s a completely different question than “Do I have cyber insurance?”

“We have insurance” won’t really help you when you are completely down and your leadership team is juggling what a data breach really does to your business. The importance of a response and recovery plan can not be overstated! Will you get cash to help you during the crisis or will you submit receipts and get cash based on what you submit? How much cash can you get based on the limits of your policy?

They actually break all of the losses into four different categories, which they jokingly call the 4Ls instead of the DBIR’s 4As. It’s an interesting framework if you want to dig into the report, but for our purposes one thing jumped off the page… Business interruption is now the biggest financial pain point.

We always talk about how the expense of business interruption is huge and that you need to keep that in mind. The response and recovery, yes, that has the high-end costs at the beginning but over time what really builds up is business interruption cost. You can see that it shoots up between 2023 and 2024. Insurance might pay for some of the loss. It doesn’t make your patients magically come back after you cancel appointments for two weeks.

When you are no longer operating properly that cost is often much more than you may expect. Many people have coverage for that but is it really going to cover everything you need? The overall median number is $90,000 being paid out for business interruption, with the top number being roughly $4.8 million. The big jump was from 2023 to 2024. It had a 51% growth of losses due to business interruption.

In fact as they say, “Across all years, business interruption losses as a whole contingent or not account for 50% of total known loss amounts in supply chain or third-party incidents.”

One thing I thought was really worth mentioning was their discussion about cyber insurance. They point out that if you haven’t really looked at your policy in the last couple of years, you probably should.

The reason isn’t necessarily because premiums changed. It’s because the nature of the losses has changed.

Years ago, everybody was worried about paying for incident response, forensic investigators, notifications, maybe credit monitoring. Those costs are still there.

But this report shows that business interruption has become one of the biggest financial drivers. If your systems are down for days or weeks, that’s where the money starts disappearing.

So don’t just renew your cyber insurance because the bill came in the mail. Sit down with someone who understands cyber insurance and ask whether the coverage you bought three or four years ago still matches today’s risks.

Just like we tell people not to treat a Security Risk Analysis as a one-and-done project, don’t treat your cyber insurance that way either. The threat landscape changes. Your business changes. Your policy should be reviewed with those changes in mind.

Healthcare Findings

Ransomware

• Overall BIS: Ransomware is one of the dominant cyber claim types analyzed.
• Healthcare: 39% of healthcare claims involve ransomware.
• Companion DBIR: Only about 31% of ransomware victims paid a ransom.
• Paying the ransom isn’t the biggest financial story anymore.
• Business interruption often costs more.

Business Email Compromise (BEC)

• Overall BIS: BEC is one of the other dominant financially motivated claim types.
• Healthcare: 22% of healthcare claims involve BEC.
• Still largely a people and process problem.

Business Interruption

• Overall BIS:
  • Largest financial loss category.
  • Median loss about $90,000.
  • Increased 51% from 2023 to 2024.
• Healthcare:
  • Represents 24% of known losses.
  • Downtime affects both patient care and revenue.

External Liability

• Overall BIS:
  • Less common than first-party losses but can be very expensive.
• Healthcare:
  • Represents 23% of known losses.
  • Median liability loss is 57% higher than the overall median.
• Think beyond HIPAA: lawsuits, regulators, contractual obligations.

Response & Recovery

• Overall BIS:
  • Still a significant portion of losses.
• Healthcare:
  • Represents 29% of known losses.
• Incident response, restoration, investigations, notifications.

Takeaway

• Healthcare organizations should review cyber insurance, especially business interruption coverage.
• Don’t just renew—reassess whether the policy reflects today’s risks.
• Business continuity and incident response planning matter as much as technical recovery.

At the end of the day, the goal isn’t to memorize statistics—it’s to use them to make smarter decisions. Whether you’re a healthcare provider, business associate, or simply responsible for managing risk, knowing what data breaches actually cost can help you prioritize the protections that matter most. After all, the best time to figure out if your insurance, response plan, and business continuity strategy are up to the task is before you’re explaining to everyone why Tuesday’s hamburger suddenly became a whole lot more expensive.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.