If criminals manage to exploit any of these vulnerabilities, the damage could be severe and can include the following:

▶ Financial losses
- Ransom payments.
- Forensic and computer expert costs.
- Data recovery and clean-up costs.
- Legal fees, such as e-discovery and notification costs (including credit monitoring and identity protection services).
- Data protection fines/penalties.

▶ Reputational damage
- Damage caused by unauthorised access and use of personal, sensitive and payment information.
- The loss of website control.
- Negative PR and communications.

▶ Disruption
- Recovery takes not only money but time. Criminals may have compromised your systems or data in multiple ways to extort you again. This is why a forensic investigator must perform a thorough check of your system.
- Your normal operations may be disrupted through the downtime of systems and while you get back up and running.

For these reasons, the costs associated with cyber incident recovery can be substantial, often exceeding £200k in the case of a privacy breach, highlighting the importance of proper cyber risk management and considering cyber insurance for charities and not-for-profits.