After nine months, a massive cyberattack on Change healthcare has still not been fully resolved and the costs so far are staggering. Close to $2 billion and counting. It was recently revealed that as many as 100 million people’s information was exposed in the attack, with 6TB of sensitive data stolen, including health insurance info, billings, claims, payment information, and much more.

The risks of cyberattacks range from paying the hackers to paying salaries to workers who can’t access their computers. What is often overlooked, however, are the secondary costs. Here are the most critical secondary risks that every business leader must understand and prepare for:

1. Insurance Denials

Cybersecurity insurance may provide a safety net, but insurers often deny claims if they determine the company didn’t meet specific security standards or failed to adhere to policy conditions. For instance, failing to implement basic protections like multi-factor authentication could result in denied payouts, leaving companies to shoulder the entire financial burden. This of course only applies when there was cyberinsurance to begin with.

2. Regulatory Fines

The financial repercussions of non-compliance with laws like GDPR, CCPA, or HIPAA can be devastating. Companies may face penalties ranging from thousands to millions of dollars, depending on the severity of the breach and the jurisdictions involved. Examples include a $10M fine for the parent of the NYSE by the SEC and GEICO and Travelers were fined $11.3M by the New York Department of Financial Services (NYDFS).

3. Loss of Customer Trust

A breach doesn’t just expose sensitive data; it erodes trust. Customers may lose confidence in your ability to safeguard their information and take their business elsewhere. Studies consistently show that trust is one of the hardest factors to regain after a cyberattack.

4. Reputational Damage

Negative headlines and media scrutiny can permanently damage a brand's reputation. Even if a company recovers operationally, the stigma of being associated with a high-profile breach can linger for years, affecting customer acquisition and retention.

5. Increased Costs Across the Board

• Higher Insurance Premiums: Post-breach, cybersecurity insurance premiums can skyrocket, or coverage may become harder to secure.
• Investments in Cybersecurity: Businesses often need to make significant upgrades to their systems to prevent future attacks, adding to the financial toll.
• Retention Costs: To maintain their customer base, companies may need to offer discounts, promotions, or other goodwill gestures.

6. Regulatory Scrutiny and Oversight

Regulators often impose additional oversight after a breach, requiring regular audits and compliance checks. These measures increase administrative burdens and can slow down operations.

7. Operational Disruptions

Cyberattacks can derail critical projects and redirect resources away from growth initiatives. From delayed product launches to extended system downtimes, the operational impacts can ripple across the organization.

8. Employee Impact

The fallout of a cyberattack often extends to employees, who may feel demoralized or even blamed. Skilled staff might leave the company, fearing reputational harm, which can exacerbate recruitment challenges.

9. Competitive Disadvantage

Competitors may exploit your vulnerability to position themselves as more secure and reliable, winning over your customers and partners. Meanwhile, your market position may suffer due to lingering trust issues.

10. Long-Term Financial and Strategic Challenges

The combination of lost revenue, legal costs, and reputational damage can make it harder to attract investors, secure funding, or achieve growth targets. The effects of a cyberattack often outlast the immediate recovery period, leaving businesses struggling to regain their footing.

The true cost of a cyberattack goes far beyond fixing the technical problem. To mitigate these risks:

• Invest in Proactive Cybersecurity Measures: Ensure compliance with industry standards and regularly audit your defenses.
• Review Your Cyber Insurance Policies: Understand the fine print to avoid surprises.
• Develop a Crisis Management Plan: Have a detailed response strategy that includes communication plans, legal support, and customer outreach.
• Educate Your Workforce: Training employees on cybersecurity best practices can prevent many attacks.
• Hire a top-rated IT services firm/MSP like Apex Technology Services, to help with the above and more.

The question isn’t whether your business will face a cyberattack—it’s whether you’ll be prepared for the aftermath. Ignoring these secondary risks could mean the difference between a temporary setback and a complete collapse.

Cybersecurity is no longer just an IT issue; it’s a business-critical concern. The secondary effects of an attack can outstrip the initial damage, making it essential for businesses