Ransomware Impact Calculator
Total the cost of a ransomware event: downtime, lost work in the RPO window, response, notification and insurance retention.
About Ransomware Impact Calculator
Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline. The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
Formulas
Ransomware Impact
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord.
- hourlyLoss
- Revenue plus idle-productivity cost for each hour of outage
- rpoHours
- Hours of work lost because the last clean backup predates encryption
- responseCost
- Forensics, legal, negotiation and overtime
- costPerRecord
- Notification, credit monitoring and regulatory cost per record
After insurance
retainedLoss = totalImpact − min(totalImpact, max(0, totalImpact − retention) × coverageShare)
- retention
- Deductible you pay before the policy responds
- coverageShare
- Proportion of the excess loss the policy pays
Worked example
With the default values below, Ransomware Impact Calculator returns Total Impact of $14,884,000. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Business downtimeaccepts 0–8,760 hours
- 72 hours
- Revenue and productivity lost per houraccepts 0–100,000,000 currency/hour
- 45,000 currency/hour
- Data-loss window — work since the last good backupaccepts 0–8,760 hours
- 12 hours
- Value of one hour of lost workaccepts 0–10,000,000 currency/hour
- 12,000 currency/hour
- Incident response, forensics and legalaccepts 0–500,000,000 currency
- 250,000 currency
- Personal records exposedaccepts 0–1,000,000,000 records
- 250,000 records
- Notification and remediation per recordaccepts 0–10,000 currency/record
- 45 currency/record
- Ransom demandedaccepts 0–1,000,000,000 currency
- 1,500,000 currency
- Share of the loss the policy paysaccepts 0–100 %
- 60 %
- Policy retention or deductibleaccepts 0–100,000,000 currency
- 250,000 currency
Results
- Total Impact
- $14,884,000
- Downtime Loss
- $3,240,000
- Lost Work in the RPO Window
- $144,000
- Notification and Record Costs
- $11,250,000
- Loss You Retain After Insurance
- $6,103,600
- Cost of Every Extra Hour Down
- $48,472
- Ransom in Context
- Demand is small next to the loss — expect commercial pressure to pay, and expect it not to restore the data reliably
Step by step
- 1Values used
- 2Ransomware Impact
- 3After insurance
- 4Total Impact= 14,884,000
- 5Downtime Loss= 3,240,000
- 6Lost Work in the RPO Window= 144,000
- 7Notification and Record Costs= 11,250,000
- 8Loss You Retain After Insurance= 6,103,600
- 9Cost of Every Extra Hour Down= 48,472
Assumptions and limits
- The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Ransomware Impact calculated?
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord. Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline.
Why does Ransomware Impact matter?
The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
What values do I need to enter?
This calculator takes 10 inputs: Business downtime, Revenue and productivity lost per hour, Data-loss window — work since the last good backup, Value of one hour of lost work, Incident response, forensics and legal, Personal records exposed, Notification and remediation per record, Ransom demanded, Share of the loss the policy pays, Policy retention or deductible. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should the ransom be added to the total?
No — it is a separate decision, and paying does not remove the downtime, the response cost or the notification obligation. The model shows the demand as a ratio of the loss so you can see the commercial pressure without treating payment as a recovery plan.
Why does the RPO window cost anything if backups worked?
Because backups restore to a point in time. Every transaction, document and email created after the last clean backup is gone, and someone has to recreate or reconcile it — that is real labour and sometimes irrecoverable revenue.