Ransomware Impact Calculator
Total the cost of a ransomware event: downtime, lost work in the RPO window, response, notification and insurance retention.
Inputs
Total Impact
$14,884,000
Downtime Loss
$3,240,000
Lost Work in the RPO Window
$144,000
Notification and Record Costs
$11,250,000
Loss You Retain After Insurance
$6,103,600
Cost of Every Extra Hour Down
$48,472
Ransom in Context
Demand is small next to the loss — expect commercial pressure to pay, and expect it not to restore the data reliably
Step by step
Values used
Business downtime = 72 hours; Revenue and productivity lost per hour = 45,000 currency/hour; Data-loss window — work since the last good backup = 12 hours; Value of one hour of lost work = 12,000 currency/hour; Incident response, forensics and legal = 250,000 currency; Personal records exposed = 250,000 records; Notification and remediation per record = 45 currency/record; Ransom demanded = 1,500,000 currency; Share of the loss the policy pays = 60 %; Policy retention or deductible = 250,000 currency
Ransomware Impact
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord.
After insurance
retainedLoss = totalImpact − min(totalImpact, max(0, totalImpact − retention) × coverageShare)
Total Impact
= 14,884,000
Downtime Loss
= 3,240,000
Lost Work in the RPO Window
= 144,000
Notification and Record Costs
= 11,250,000
Loss You Retain After Insurance
= 6,103,600
Cost of Every Extra Hour Down
= 48,472
How it works
Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline. The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
Formulas
Ransomware Impact
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord.
- hourlyLoss
- Revenue plus idle-productivity cost for each hour of outage
- rpoHours
- Hours of work lost because the last clean backup predates encryption
- responseCost
- Forensics, legal, negotiation and overtime
- costPerRecord
- Notification, credit monitoring and regulatory cost per record
After insurance
retainedLoss = totalImpact − min(totalImpact, max(0, totalImpact − retention) × coverageShare)
- retention
- Deductible you pay before the policy responds
- coverageShare
- Proportion of the excess loss the policy pays
Frequently Asked Questions
How is Ransomware Impact calculated?
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord. Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline.
Why does Ransomware Impact matter?
The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
What values do I need to enter?
This calculator takes 10 inputs: Business downtime, Revenue and productivity lost per hour, Data-loss window — work since the last good backup, Value of one hour of lost work, Incident response, forensics and legal, Personal records exposed, Notification and remediation per record, Ransom demanded, Share of the loss the policy pays, Policy retention or deductible. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should the ransom be added to the total?
No — it is a separate decision, and paying does not remove the downtime, the response cost or the notification obligation. The model shows the demand as a ratio of the loss so you can see the commercial pressure without treating payment as a recovery plan.
Why does the RPO window cost anything if backups worked?
Because backups restore to a point in time. Every transaction, document and email created after the last clean backup is gone, and someone has to recreate or reconcile it — that is real labour and sometimes irrecoverable revenue.