How much would downtime from a cyberattack cost you?

How it is calculated

The calculator shows the whole formula and, when you calculate, repeats it with your numbers in a table. Each letter is a figure you enter or a labelled value you can change.

• V = F / A. Average sales per day of activity: your turnover divided by your days of activity.
• L_v = V × (1 − r) × (d × p + g × k). Lost sales. These are the sales that are not made. It is not what you lose: it does not deduct what you save by not producing (raw materials, goods, transport).
• L_m = L_v × m. Lost profit (contribution margin). This is the profit you stop making, measured on your contribution margin. The Spanish Civil Code calls it lucro cesante, or loss of profit (art. 1106).
• X = HE × cHE + R1 + R2 + R3 + N + Q + O. Extra costs you pay (out-of-pocket loss): overtime at its real cost, external help, equipment and licences, data recovery, advice and communication, contractual penalties and other costs. You enter all of them.
• T = L + X. Total: the money you stop taking in or making (L, depending on the mode you choose) plus the extra costs you pay.
• W = E × h × C × d × i. For your information, not added: salaries paid during the downtime. The margin does not deduct salaries: you pay them anyway, incident or not. W is work that was paid for but not used, which is why it is shown separately. Adding it would count money that the incident does not make you pay again. If you want to see it in the total, tick it in the detailed mode (“Add anyway”).

Choose how you count the money you stop making: “Lost sales” (simple: counts the sales that are not made, without deducting costs.) or “Lost profit (contribution margin)” (recommended: counts the profit you stop making; you need your margin). You will also see the total if the downtime lasted half as long or twice as long: these are scenarios you choose, not probabilities.

The calculation covers the days of downtime and the days at reduced capacity that you enter. It does not project any later effects.

What the calculation leaves out

• Ransom. We do not include it: it is not a cost you should plan for, and paying does not guarantee that you get your data back.
• Insurance. Check your policy; we do not deduct it because every policy is different.
• Loss of future customers and reputation. We do not estimate it: it would depend on assumptions we cannot justify. If you have your own figure, add it under “Other costs”.

It does not estimate the probability of suffering an incident, it is not an expert valuation or a compensation calculation, and it does not replace your financial adviser or your insurance policy.

Fines: a legal reference, not a forecast

Fines do not depend on the days of downtime but on whether you met your obligations. These are the maximums set by law, for reference. The authority assesses each case, and an incident does not mean a penalty. We do not calculate probabilities.

Below the result you will see a collapsed panel with the maximums under the GDPR (EU), Spain's Royal Decree-law 12/2018, NIS2 (EU directive minimums; in Spain, once the transposing law is passed) and DORA (EU), each with its article. They are never added to the total or calculated from the turnover you enter: the turnover that counts is the worldwide turnover of the undertaking (group) for the preceding financial year, not necessarily the turnover you entered.

Your data

The calculator works on a separate page that does not load analytics, advertising or third-party tools, and can only connect to this same site. Your figures are kept only in memory and are lost when you reload or leave. If you accept analytics cookies, on the calculation page we count in aggregate which features are used (for example, “result shown”), without sending cookies in the beacon, without amounts and without your data. More information in our privacy policy.