Defence Online

Counting the cost of cybercrime

June 9, 2026

Cybercrime hits businesses where it hurts. While stolen cash leaves a hole, a damaging data breach brings a reputation that can take years to shake off.

In 2017, when hackers struck Equifax, one of the big three consumer credit reporting agencies, the details of more than 147 million people were compromised. Highly sensitive, personal data relating to nearly half the US population fell into the hands of criminals.

What truly alarmed investors wasn’t just the breach itself but evidence of a failure to patch a known vulnerability, along with executives selling shares after discovery but before public disclosure, and widely criticised weaknesses in Equifax’s incident response and communication.

When the breach was publicly disclosed – two months after discovery – there was confusion and inconsistency in early public announcements. Market reaction was savage: shares fell 13 – 18% within days, billions were wiped from market value, and lawsuits and investigations exploded.

As well as immediate loss of trust, and operational paralysis, data breaches can trigger regulatory exposure. Equifax ultimately settled with regulators at a cost of $700 million.

Data breaches can lead to seismic consequences. In 2013, when 110 million customer records were taken from Target Corporation, investors were shaken by an immediate fall in the share price in response to reputational damage and potential losses. When it emerged that the attackers had found their way in via a third-party contractor, markets were spooked by the fear that companies were only as secure as their weakest supplier.

In 2021, a ransomware attack forced Colonial Pipeline to interrupt fuel supply to much of the US east coast, leading to shortages and panic-buying, and rattling energy stocks, infrastructure operators, and insurers. This attack showed how real-world disruption can stem from a single cybercrime.

Even when customers’ data is not the primary target, a breach can still cause public humiliation, as Sony Pictures found in 2014 when attackers leaked executives’ emails, unreleased films, salary details, and internal conversations.

A data breach, whatever its nature, can have an immediate impact on a company’s systems, productivity, and share price. What truly unnerves shareholders is a perception of leaders appearing to be ineffective, before and after the incident. Helplessness undermines reputation.

As cyber attacks increase in scale and frequency, businesses without trained defences may be regarded as vulnerable by shareholders and other interested parties. Firewalls are only one part of the solution. Reputation hangs on actions taken by people, both before and after an attack.

Preventing a breach, and managing events following an incident, both require skills in leadership, communication, and managing uncertainty. Preparation is essential even when it’s hard to identify potential aggressors and their motives. After an attack, when the consequences are still unclear, swift and decisive action demonstrates integrity, contains fallout, and preserves trust.

Complacency can be catastrophic. Participation in our Psychological Self-Defence programme, strengthening human defences against cybercrime, allows leaders and their people to demonstrate proactive action – not only to shareholders, but to criminal gangs who might look elsewhere for a softer target. Talk to us, we’re Working Voices, and we’re ready to help: wvpsd.com

Read part two of the series.

Post written by: Vicky Maggiani

Vicky has worked in media for over 25 years and has a wealth of experience in editing and creating copy for a variety of sectors.