Did you know that more than 300,000 cybercrimes were recorded in Spain alone during 2021 (according to the Statistical Crime System report)? Or that in 2022, companies suffered an average of 1,168 cyberattacks per week?
Against this backdrop, it is essential for Spanish companies to invest in cybersecurity and avoid the heavy costs that follow a cyberattack. So, how much does it usually cost a company to fall victim to a cyberattack? Let’s take a look.
What is a cyberattack?
A cyberattack is an unwanted attempt to damage, access, alter, disable, steal, or destroy confidential information, or to interrupt the normal operation of information systems. It is usually carried out through unauthorized access to those systems, with the goal of harming individuals, institutions, or companies.
Cybercrime and the lack of cybersecurity rank eighth on the list of the 10 global risks humanity will face over the next decade, according to the latest Global Risks Report from the World Economic Forum. It sits alongside issues such as the cost of living and environmental problems.
Most common motivations
The motivations behind a cyberattack usually fall into three categories:
- Criminal: the goal is usually financial gain.
- Political: attackers typically want to draw attention to their causes through hacktivism.
- Personal: the goals here are far more subjective, but they tend to involve financial gain or simply interrupting a company’s operations.
Types of cyberattacks
Today there is already a wide range of different types of cyberattacks:
- Malware.
- Phishing.
- Denial-of-service (DoS) attacks.
- Brute-force attacks.
- Data interception attacks.
- Social engineering.
- Ransomware.
- And more.
But the most important thing to understand about cyberattacks is that they are constantly evolving, driven in part by advances in technology.
For example, in recent months we have seen how cybercriminals have found an ally in ChatGPT. Find out how cybercriminals are using ChatGPT to create malicious tools. These tools are already being used to access and steal confidential information from other people’s systems. Infostealers are one example.
Cyberattacks on companies
Cyberattacks on companies have become a constant. According to the 2022 CyberEdge Group report, more than 90% of Spanish companies suffered at least one over the past year.
So it comes as no surprise that the data gathered in the latest Hiscox Cyber Readiness Report 2022 shows that the average amount surveyed companies spent on cybersecurity rose by more than 60% in the last year, and has climbed 250% since 2019.
The main reason for this increase is companies’ concern about data security and privacy.
Most affected companies and sectors
The same report (Hiscox Cyber Readiness Report 2022) tells us that hackers no longer focus solely on large corporations. In recent years they have increasingly turned their attention to small and medium-sized businesses.
As for sectors, the hardest hit in 2022 were:
- Leisure.
- Tourism.
- Professional services.
- Retail and wholesale.
Most common types of cyberattacks on companies
By far the attack companies fear most is ransomware. Ransomware is a type of malware that installs itself on a device and encrypts all the information on the system, then demands a payment to unlock it.
It is precisely this extortion that makes it the most feared attack, because it adds an extra cost on top of the usual system recovery. Last year, 64% of companies hit by a ransomware attack chose to pay the ransom demanded by the cybercriminals.
However, according to the Hiscox Cyber Readiness Report 2022, it is not the most common type of attack (although it does make the top three):
- Denial of service (38%).
- Financial fraud (32%).
- Ransomware (22%).
As for the entry points attackers use, specialists point in particular to compromised corporate email, cloud servers, corporate servers, and employees’ personal mobile devices.
>> You may also be interested in: 5 cybersecurity threats we need to prevent in 2023
How much does a cyberattack cost a company?
“According to experts, the average cost of a cyberattack in Spain in 2021 rose to 105,655 euros.”
El Economista.
That figure appears to have grown enormously in the space of a single year, since the average in 2020 was 54,388 euros.
When it comes to ransomware, companies have paid an average of 19,400 euros to recover their information. However, paying has not always meant getting their data back. In fact, 47% of companies have gone on to suffer another attack, precisely as a result of having paid the first time.
But beyond a possible ransom payment, where does this money usually go after a cyberattack? Some examples include:
- Losses resulting from the data breach.
- Specialists brought in to resolve the incident.
- Preventing future attacks.
- Hiring expert staff.
- Employee training.
- Hardware.
- Software.
- Data protection fines (yes, even though business owners are the victims of these attacks, they are still exposed to substantial fines).
Other consequences
Financial costs are not the only consequences companies face after falling victim to a cyberattack.
For example, according to Hiscox, 28% of the companies surveyed for its report lost customers following a cyberattack.
Other losses include:
- Damage to brand reputation.
- Impact on the company’s solvency.
- Greater difficulty attracting new customers.
- Loss of business partners.
Cyberattacks: how to prevent them
Now that we know what a cyberattack can cost a company, the next step is clear: how can we prevent one?
There are many preventive measures to keep in mind at the company level, such as using strong passwords, intrusion detection systems, threat monitoring, anti-malware software, system updates, and so on.
Still, the most important step in preventing cyberattacks, and one that should be a regular practice at every company regardless of size, is cybersecurity training for employees.
Cybersecurity training for employees
At the end of the day, the vast majority of entry points for attacks on a company’s systems come through people, whether through fraud, deception, malicious links or files, and so on. That is why building a strong cybersecurity culture in your company will make that unwanted access much harder to achieve.
Now that you know the risks, do you think your company needs cybersecurity training? If so, I have good news: you can now enroll (as an individual or as a company) in the Online Master’s in Cybersecurity and Digital Prevention, with the World Compliance Association:
FAQs about cyberattacks
What are cyberattacks?
Cyberattacks are malicious actions carried out by individuals or groups to access, damage, or steal information from computer systems, networks, or internet-connected devices. These attacks can involve the use of computer viruses such as malware or phishing, among others.
How do cyberattacks affect the privacy of a company’s customers?
Cyberattacks can compromise the privacy of a company’s customers by stealing or exposing personal information such as names, addresses, social security numbers, and banking details. This can lead to identity theft and financial fraud.
What current trends in cyberattacks are emerging?
Some of the current trends in cyberattacks include the use of ransomware to hold data hostage, increasingly sophisticated phishing attacks, the growing popularity of social engineering attacks, and the use of artificial intelligence and machine learning techniques by cybercriminals.
What role do a company’s employees play in preventing cyberattacks?
A company’s employees play a very important role in preventing cyberattacks, since they are the first point of contact with cyber threats. Cybersecurity training and the adoption of safe practices by employees can help minimize the risk of cyberattacks.
