Mission 04
The Real Cost of Cyber Attacks
A cyber incident can hurt a business even when no money is stolen. Downtime, recovery work, lost customer trust and contractual or regulatory questions all add up, so it helps to understand them before anything goes wrong.
In this mission you will
- Describe the main types of cost from a cyber incident: direct loss, downtime, recovery, lost trust, and contractual and regulatory exposure.
- Explain the terms RTO and RPO in plain language and why they matter to a small business.
- Plan how a critical service would keep running manually during an outage, including who approves and how customers are informed.
- Estimate, with stated assumptions, the impact of a short and a longer outage of one critical service.
It is not only about stolen money
When people think of a cyber attack, they often picture money disappearing from a bank account. That can happen, and it is serious. But for many small businesses, the bigger damage comes afterwards. The billing system is down, so invoices cannot go out. Staff spend days rebuilding files. A key customer starts asking questions. A contract turns out to require that incidents are reported. None of this shows up as a single transaction, yet together it can affect the business for weeks or months.
Where the costs come from
- Direct loss: money sent to a fraudster, or payments that cannot be recovered.
- Downtime: hours or days when the business cannot bill, dispatch, take orders or answer customers, while salaries and rent still fall due.
- Recovery: time and outside help to clean devices, restore data, reset accounts and check what happened.
- Lost trust: customers or partners who become hesitant, ask for assurances or move some work elsewhere.
- Contractual exposure: obligations in customer or partner agreements, such as notifying them about incidents or protecting their data.
- Regulatory and legal exposure: possible reporting duties and legal advice, especially where personal data or financial services are involved.
- People cost: stress, overtime and distraction for owners and staff, which often goes unmeasured.
Downtime is the cost most people underestimate
A small business usually depends on a handful of digital services. If the accounting software, the main email account or the billing computer stops working, orders pile up and cash flow slows down. Customers may tolerate a short delay, but a longer one can mean missed delivery dates and penalties. The impact depends on the business and on timing. An outage during the month-end GST filing period or a festive sales rush hurts far more than one on a quiet day.
Two useful terms: RTO and RPO
RTO, or Recovery Time Objective, is the target time within which a service should be working again after a disruption. For example, ‘billing should be back within one working day’. RPO, or Recovery Point Objective, is the maximum amount of data you can afford to lose, measured in time. For example, ‘we can lose at most the last few hours of entries’. RPO tells you how often you need backups. RTO tells you how quickly you must be able to restore them. Neither needs to be perfect. Simply agreeing them turns a vague hope into a plan.
Thinking through the impact of an outage
- 1Pick one critical service, such as billing or order processing.
- 2Ask what happens if it is unavailable for four hours, and then for one full working day.
- 3Note who is affected: customers, suppliers, staff, partners.
- 4Decide what manual workaround could keep essential work going, and who can approve it.
- 5Identify what data you would need to recover, and where the latest good copy is.
- 6Agree who will inform customers and what they will say.
- 7Write down your assumptions, so the estimate can be improved later.
Practical business example
Three quiet days at Kaveri Fresh Foods
Kaveri Fresh Foods, a fictional 20-person snacks distributor in Mysuru, found one morning that its billing computer showed a ransom note and every file was locked. No money left the bank. The owner, Priya, assumed the damage was limited. It was not. For three days the team could not raise invoices, so dispatches were held and two retail chains asked why deliveries were late. Staff re-entered orders from WhatsApp messages and paper copies. An outside IT partner spent days cleaning the computer and restoring data from an old backup, and some recent entries were lost for good. One customer asked for written confirmation of how its data was protected, as its supplier agreement required. Priya now keeps a tested backup off the main computer and has a simple manual billing plan.
The lesson: The cost was downtime, recovery effort, lost data and strained customer trust, with no money stolen at all. Planning for recovery limits all of these.
Key takeaways
- The cost of a cyber incident goes well beyond stolen money: downtime, recovery, lost trust and contractual or regulatory questions all matter.
- Downtime is often the largest and most underestimated cost for small businesses, and timing can make it much worse.
- RTO is the target time to restore a service; RPO is the maximum data loss you can accept, measured in time.
- An approved manual workaround and honest, agreed customer communication limit the damage during an outage.
- For legal and reporting duties, check official sources such as CERT-In and MeitY or a qualified adviser rather than relying on hearsay.
Scenario lab · +25 XP
Billing is down for the day
You are the operations lead at Malabar Hardware Supplies, a fictional 18-person wholesaler in Kozhikode. At 10 a.m. the accounting and billing software stops working after a suspicious pop-up appeared on the billing computer. The IT partner says it may take most of the day to investigate and restore. Trucks are waiting to be loaded and customers are calling for invoices.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What is your first priority?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Estimate the impact of one outage
Choose one critical service and think through what an outage would really mean. Describe impacts in general terms and write down your assumptions. Do not record passwords, account numbers or customer details.
- 1.Choose one critical service, such as billing, order processing or the main email account.
- 2.Describe the impact if it were unavailable for four hours: who is affected and what work stops.
- 3.Describe the impact if it were unavailable for one full working day, including customers, deliveries and staff time.
- 4.Note a manual workaround that could keep essential work going, and who would approve it.
- 5.Suggest a simple RTO and RPO for this service and check whether your current backup could meet them.
- 6.List your assumptions and share the one-page note with the owner for discussion.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress