Notable Breaches and Their Costs

Cyberattacks and their costs are the loss side of the economics of cybersecurity. Security spending exists because breaches are expensive, and the size and visibility of those losses — to companies, governments, and the wider economy — is what turns security from a discretionary IT line item into a board-level obligation. Every well-documented breach cost strengthens the case for the next dollar of defensive spending, feeds the pricing of cyber insurance, and drives new regulation. This page sets out what a breach actually costs, the benchmark figures, the costliest events on record, and a history of major hacks from the origins of computer intrusion in the 1970s to the present.

A note on the numbers throughout: breach-cost figures come from three very different methodologies that are frequently, and misleadingly, compared side by side. A single-company response cost (what one victim spent) is measured and auditable. An aggregate victim cost (the total across every organization hit by one campaign) depends on how many victims are counted and how each was modeled. And a global economic-damage estimate — most common for the early worms — is a broad, contemporary figure that often includes lost productivity worldwide and is frequently inflated. The three are not comparable, and the largest headline numbers are usually the least precise. Where possible, figures below are labeled by type.

What a breach costs — the anatomy

A breach's total cost is far larger than any ransom and accrues over years. The main components:

The industry shorthand divides these into direct costs (detection, notification, remediation, ransom) and indirect costs (lost business, churn, reputation), with indirect costs typically the larger and longer-lasting of the two.

Average cost benchmarks

The most widely cited benchmark is IBM's annual Cost of a Data Breach study. Its 2025 edition reported the first decline in the global average in five years, attributed largely to faster detection and containment using AI-assisted defenses, alongside a record-high figure for the United States.

These are averages across thousands of mostly mid-sized incidents. The headline events below sit far out on the tail — the breaches that shape budgets, insurance markets, and law.

The costliest events on record

The largest headline figures belong to the self-spreading worms of the early 2000s, whose global economic-damage estimates — lost productivity across millions of machines — run to tens of billions of dollars but are broad and contemporary rather than audited. The costliest targeted events are the 2017 state-linked wiper NotPetya and the 2023 MOVEit supply-chain campaign. Because the methodologies differ, the ranking below mixes categories and is best read as orders of magnitude, not precise comparisons.

A history of major hacks, by era

Era 1 — Origins: phreaking and the first intrusions (1971–1989)

The first attacks predate the internet and were about curiosity, espionage, and proof of concept rather than money. This era established the templates — worms, espionage, and extortion — that everything since has scaled.

Era 2 — The worm plague and the first big money (1994–2004)

As the internet went mainstream, self-spreading email worms caused the largest economic-damage figures ever recorded, while the first large financial thefts showed that intrusion could move real money.

Era 3 — The payment-card and data-breach era (2005–2013)

Attackers professionalized around a clear business model: steal payment cards and personal data in bulk and sell it. This era produced the first nine-figure corporate breach costs and the first large nation-state intrusions against Western companies.

Era 4 — Mega-breaches and nation-state escalation (2014–2020)

Breach sizes reached the hundreds of millions to billions of records, regulators began levying serious fines, and state-run operations moved from espionage to destruction and election interference.

Era 5 — Supply chain, critical infrastructure, and the ransomware economy (2021–2026)

Ransomware industrialized into a service economy (see Ransomware-as-a-Service), attacks began shutting down physical infrastructure, and single incidents reached billions in single-company cost.

Sovereign and nation-state operations

State-run attacks are a distinct class because their objective is usually strategic — espionage, sabotage, or coercion — rather than direct profit, and their costs fall on governments and critical infrastructure as much as on companies. The landmark cases: Stuxnet (2010, US/Israel), the first cyber weapon to cause physical damage, destroying centrifuges at Iran's Natanz enrichment plant; Sony Pictures (2014, North Korea); US OPM (2015, China); NotPetya (2017, Russia), a state wiper that became the costliest cyberattack in history by escaping its intended target; SolarWinds (2020, Russia); and the ongoing Salt Typhoon and Volt Typhoon campaigns (China), which respectively conduct telecom espionage and pre-position inside US critical infrastructure. North Korea occupies a category of its own, running cyber as a revenue line for a sanctioned state — the Bangladesh Bank SWIFT theft (2016) and the Bybit heist (2025) among the largest financial cyber-thefts ever. Nation-state activity is covered in depth on Nation-State & APTs and Sovereign & Government.

Why breach costs matter to the industry's economics

Documented breach costs are the mechanism that converts risk into spending. They do three things at once. They manufacture demand: a peer's nine-figure loss is the single most effective argument for a security budget, which is why threat and loss data are a leading indicator of where the next spending — and the next wave of acquisitions — will concentrate (see Threat as a Leading Indicator). They price cyber insurance: carriers translate loss experience into premiums, sub-limits, and mandatory controls, making the insurer a buyer behind the buyer (see Cyber Insurance). And they drive regulation: nearly every major breach-notification law, disclosure rule, and fine regime traces back to a landmark incident (see Regulation). The loss side and the spend side are two halves of the same market.

→ Cross-references: Threat Economy, Ransomware-as-a-Service, Nation-State & APTs, Threat as a Leading Indicator, Cyber Insurance, Regulation, Economics.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.