What a Cyber Incident Actually Costs — and What Insurance Covers

When people think about the cost of a cyberattack, they think about the ransom. The number on the screen — "$75,000 in Bitcoin within 72 hours." That's the visible number, the one that makes the ransom demand dramatic. It's often the smallest part of the actual cost.

The average Canadian cyber insurance claim pays out around $166,000. The average total economic impact of a ransomware attack on a Canadian small business is estimated at $1.27 million. That gap — more than $1 million — is what the business pays out of pocket, whether they have insurance or not.

Understanding where those numbers come from is important before you decide what coverage to buy, and before you think you're protected.

The Full Cost Breakdown

Ransom payment: $15,000–$150,000

For small Canadian businesses, ransom demands typically range from $15,000 to $150,000, with the amount calibrated based on the apparent size and financial capacity of the target. Most small business cyber policies cover ransom payments (subject to sanctions screening — you can't pay a sanctioned entity), but many have sublimits. A $500,000 policy with a $50,000 ransom sublimit is only paying $50,000 of your ransom, even if the demand is $80,000.

Note: paying the ransom does not guarantee recovery. Approximately 65% of organizations that pay receive a functional decryptor. The other 35% pay and still lose their data.

Incident response and forensics: $10,000–$50,000

Before you can start recovering, you need to know what happened: how the attacker got in, what they accessed, when they were in the network, and whether they're still there. This requires external forensic expertise — a firm that specializes in incident response. For a small business incident, expect $10,000–$50,000 in forensics costs, depending on the complexity of the attack and the size of the environment. Cyber insurance typically covers this in full, as it's in the insurer's interest to understand the incident.

Business interruption: $50,000–$400,000+

With an average downtime of 16 days, a business billing $5,000–$25,000 per day faces $80,000–$400,000 in lost revenue. Insurance covers business interruption, but almost always with sublimits (separate, lower caps within the total policy limit) and waiting periods (commonly 8–12 hours of downtime before coverage kicks in).

Business interruption is typically the largest single cost, and the gap between what insurance covers and what's actually lost is often where businesses feel the pain most acutely.

System restoration and recovery: $5,000–$30,000

Once forensics confirms it's safe to begin recovery, restoring systems — reinstalling operating systems, restoring data from backups (if clean backups exist), reconfiguring software, verifying integrity — takes technician time and sometimes new hardware. For a business without clean backups that must rebuild from scratch, this cost is significantly higher. Cyber insurance covers these costs, typically without sublimits.

Legal counsel and breach notification: $5,000–$25,000

Under PIPEDA, a breach involving personal information with significant risk of harm requires notification to the OPC and to affected individuals. Privacy lawyers to manage this process, draft notification letters, and interface with the OPC typically cost $5,000–$25,000 for a small business incident. Cyber insurance covers this. The cost of printing and mailing notification letters to hundreds of clients — sometimes more expensive than expected — is also typically covered.

Regulatory exposure: variable

PIPEDA fines for compliance failures (failing to report, failing to notify, failing to maintain breach records) can reach $100,000 per violation. These are not typically covered by cyber insurance — most policies explicitly exclude regulatory fines and penalties. Neither are costs arising from enforcement proceedings. This is worth knowing before an incident.

Reputational impact: $50,000–$500,000+

The hardest cost to quantify, and the one insurance doesn't cover. Clients who leave after a breach. Prospects who choose a competitor after reading about the incident. Contracts that are cancelled because the client no longer trusts the security of their data with you. For a professional services firm — a law office, an accounting practice, an IT company — this can be the largest cost of all, and it unfolds over months or years rather than days.

The Gap Between Insured and Uninsured Costs

The average Canadian cyber claim pays out roughly $166,000. The average total economic impact is $1.27 million. Here's roughly how the gap forms:

• Business interruption losses exceeding sublimits: $100,000–$300,000
• Ransom payment exceeding ransom sublimit: $0–$50,000
• Reputational and revenue impact not covered: $50,000–$500,000
• Regulatory fines (not covered): $0–$100,000
• Third-party claims from affected clients (sublimited or excluded): $0–$200,000
• Policy deductible: $5,000–$25,000

What Actually Protects You

Cyber insurance is not a substitute for security controls — it's a risk transfer mechanism that works best when you don't need it. The businesses that come out of a cyber incident with their finances intact are the ones that had both:

• Controls that prevented or contained the incident (MFA, EDR, offline backups)
• Insurance that covered the residual costs

An organization with no controls and cyber insurance is betting that the insurance will cover costs that often exceed the policy. An organization with strong controls and no insurance is betting that nothing will happen. Neither is a good position.

The combination — adequate controls that make an incident less likely and less severe, plus insurance that covers the costs that occur anyway — is the actual risk management strategy. And it's less expensive than recovering from an incident without either.