Imagine you discover that somebody has gained access to one of your company’s Microsoft 365 accounts.
They may have been there for days.
Perhaps weeks.
You don’t yet know.
You don’t know exactly what they’ve read.
You don’t know what they’ve downloaded.
You don’t know whether they’ve accessed SharePoint.
You don’t know whether they’ve sent emails.
And you don’t know whether they’re still there.
There’s no ransom demand.
Nothing has been encrypted.
Your computers still work.
At first glance, you might think:
“At least we haven’t lost anything.”
Unfortunately, that may be far too early to tell.
Because the real cost of a data breach isn’t necessarily money handed to an attacker.
It can be everything that happens afterwards.
A data breach doesn’t have to stop the business
This is an important distinction.
In a ransomware attack, the impact can be immediately obvious.
Files become unavailable.
Computers stop working.
Systems are encrypted.
Employees can’t work.
A data breach can be considerably quieter.
Someone might gain access to:
- Email.
- Customer information.
- Employee records.
- Contracts.
- Financial information.
- SharePoint.
- OneDrive.
- Cloud applications.
- Credentials.
- Confidential correspondence.
The business may continue operating completely normally.
That’s what makes some breaches particularly difficult.
You can lose control of information without losing access to it yourself.
The first cost is finding out what happened
Once a potential breach is discovered, somebody has to investigate.
Questions need answering.
How did the attacker get in?
Which account was compromised?
When did it happen?
Where did the login come from?
What systems could the account access?
What information was available?
Was anything downloaded?
Were emails read?
Were messages sent?
Were mailbox rules created?
Were applications authorised?
Did the attacker gain access to anything else?
Is the attacker definitely out?
That takes time.
And depending on the incident, it may require input from your IT provider, security specialists, management team and potentially other professional advisers.
The investigation itself therefore has a cost.
Then comes containment
While the investigation is happening, the immediate threat needs to be controlled.
That might involve:
- Resetting passwords.
- Revoking active sessions.
- Blocking accounts.
- Removing suspicious applications.
- Checking mailbox rules.
- Reviewing administrative access.
- Isolating devices.
- Checking other user accounts.
- Examining security logs.
- Blocking malicious destinations.
- Reviewing authentication methods.
Depending on what has happened, some legitimate access may need to be temporarily restricted while the environment is made safe.
That’s another cost that doesn’t appear on a ransom note.
Now ask the difficult question
What information did they see?
This can be much harder to answer than:
“Which computer was infected?”
Consider what might be inside an ordinary employee’s mailbox.
- Customer conversations.
- Quotes.
- Invoices.
- Contracts.
- Names.
- Telephone numbers.
- Addresses.
- Supplier information.
- Internal discussions.
- Attachments.
- Password reset emails.
- Confidential documents.
An attacker doesn’t necessarily need to steal an enormous database for a breach to matter.
Sometimes a single mailbox contains a remarkable amount of information about how a business operates.
Personal data introduces another responsibility
If personal data has been compromised, the incident may also become a data-protection issue.
Not every security incident needs to be reported to the Information Commissioner’s Office.
But organisations need a process for assessing what has happened and the risk it creates for the people affected.
Where a personal data breach is reportable, the ICO says it should be reported without undue delay and, where feasible, within 72 hours of becoming aware of it.
That clock matters.
You may still be investigating while decisions about notification are being made.
The ICO also expects organisations to document breaches and their response, including incidents that ultimately don’t need to be reported.
So incident response isn’t simply:
Fix computer. Close ticket.
There may be governance, documentation and regulatory decisions to make as well.
Your customers may need answers
Now imagine you’re one of your customers.
You receive a call:
“We’ve had a cybersecurity incident and we’re investigating whether your information may have been accessed.”
What do you ask?
Probably:
- What happened?
- What information was involved?
- When did it happen?
- How long did the attacker have access?
- Has the problem been fixed?
- Could this happen again?
- Do I need to do anything?
Those are perfectly reasonable questions.
Your business needs to be able to answer them.
That means management time.
Investigation.
Communication.
Potentially legal advice.
Potentially specialist security assistance.
Potentially contacting many customers individually.
The technical incident might have taken minutes.
The consequences can last much longer.
Trust has a value
Trust is difficult to put on a balance sheet.
But businesses spend years building it.
A customer gives you information because they expect you to look after it.
A supplier trusts communications coming from your email domain.
Employees trust you with personal information.
Business partners may give you access to their systems or data.
A breach can put some of that trust under pressure.
The impact will depend heavily on what happened and how the organisation responds.
A minor incident that is detected quickly, contained properly and communicated professionally is very different from a serious compromise that went unnoticed for months.
That’s why the response matters.
Reputation isn’t only about publicity
When people hear “reputational damage”, they sometimes imagine a company appearing on the evening news.
For most SMEs, the impact can be much more local.
- A major customer asks uncomfortable questions.
- A prospective client wants to know about your cybersecurity.
- A tender asks whether you’ve experienced security incidents.
- Your insurer requests more information.
- A partner reassesses the access you have to its systems.
- Customers become more cautious about sending sensitive information.
Perhaps nothing dramatic happens.
But confidence has been weakened.
That still has commercial value.
Your employees lose time too
Cyber incidents rarely affect only the IT department.
Management gets involved.
Finance may need to check payments.
Employees may need to change passwords.
Customers start asking questions.
Accounts may need reviewing.
Devices may need checking.
People may temporarily lose access to systems.
Someone has to coordinate everything.
Consider a 40-person company where an incident consumes an average of only two hours of employee time across the business.
That’s already:
80 working hours.
And incidents aren’t usually distributed neatly.
Senior employees may spend considerably more time on them.
The Managing Director.
Finance Director.
Operations Director.
IT contact.
Data-protection lead.
Those can be some of the most expensive hours in the company.
The invoice fraud might arrive later
There’s another danger.
Information stolen during a breach can potentially be useful after the original compromise.
Suppose an attacker has been reading a mailbox.
They now understand:
- Who your customers are.
- Who your suppliers are.
- How invoices are formatted.
- Who approves payments.
- How employees communicate.
- Which projects are underway.
- When senior people are away.
They may use that knowledge for fraud.
A convincing fake invoice isn’t convincing because the logo looks right.
It’s convincing because the attacker understands the conversation.
That’s one reason compromised email accounts can be so valuable.
Your breach can become somebody else’s attack
This links directly to something we’ve discussed previously about supplier cybersecurity.
Imagine your mailbox is compromised.
The attacker sends a malicious email to one of your customers.
But it comes from:
Your genuine email address.
The customer recognises your name.
They’ve spoken to you before.
Perhaps the message even continues an existing conversation.
Your security incident has now become their security threat.
This is where cyber risk stops respecting company boundaries.
Customers, suppliers and partners are interconnected.
A compromise in one organisation can be used to attack another.
Insurance doesn’t make the incident disappear
Cyber insurance can be extremely valuable.
Depending on the policy, it may provide access to specialist incident-response services and cover certain costs arising from an incident.
But insurance doesn’t restore lost time.
It doesn’t automatically restore customer confidence.
And it doesn’t remove the disruption of dealing with the incident.
Like every form of insurance, it’s there to help manage the financial consequences of something going wrong.
It isn’t a substitute for trying to prevent the incident in the first place.
There may be contractual consequences too
Some organisations have contractual requirements around information security.
A customer agreement might specify:
- How information must be protected.
- When incidents must be reported.
- Who must be notified.
- What security controls are required.
- What happens if those requirements aren’t met.
This becomes increasingly important when working with larger customers or regulated industries.
A cyber incident may therefore create questions beyond IT and data protection.
What have we contractually promised our customers?
It’s worth knowing the answer before an incident happens.
Recovery isn’t finished when the password changes
Imagine the original incident started with a compromised Microsoft 365 account.
You reset the password.
Problem solved?
Not necessarily.
A proper response may also need to consider:
- Were authentication methods changed?
- Are there suspicious mailbox rules?
- Was forwarding configured?
- Were applications authorised?
- Were other accounts targeted?
- Were files downloaded?
- Were emails sent?
- Was anything changed?
- Did the attacker establish another route back in?
- What allowed the compromise in the first place?
If you only remove the symptom, you may not have removed the problem.
Then comes the work nobody sees
After the immediate incident has been contained, there’s usually another stage.
Learning from it.
What went wrong?
Which control failed?
Which control worked?
Could we have detected it earlier?
Did employees know what to do?
Were the right logs available?
Were responsibilities clear?
Did we communicate effectively?
Do policies need changing?
Do security controls need improving?
Do employees need additional training?
That work matters because the objective isn’t simply to recover.
It’s to make the next incident less likely.
So what does a data breach actually cost?
Potential costs can include:
Technical investigation
Finding out what happened and how.
Incident response
Containing the attacker and securing systems.
Business interruption
Employees unable to perform some or all of their work.
Management time
Senior people coordinating the response.
Security specialists
Additional expertise may be required.
Legal and professional advice
Depending on the nature of the incident.
Customer communication
Investigating, explaining and responding to concerns.
Regulatory work
Assessing, documenting and where required reporting personal data breaches.
Remediation
Changing systems, configurations, processes or security controls.
Fraud
Where stolen information or compromised communications are used financially.
Contractual consequences
Depending on agreements with customers and partners.
Reputational damage
Loss of confidence among customers, suppliers or prospects.
Future security costs
Improvements identified following the incident.
The precise cost will be different for every business and every incident.
That’s exactly why dramatic claims such as:
“The average breach costs £X.”
aren’t always particularly useful for an individual SME.
A better question is:
What would a breach cost our business?
Try answering that question now
Imagine tomorrow you discover that one employee’s Microsoft 365 account has been compromised for a week.
Ask:
Who would lead the response?
Who would investigate?
How would we determine what information had been accessed?
Who decides whether customers need notifying?
Who assesses whether it’s a reportable personal data breach?
Do we know what logs would be available?
Would our cyber insurer need to be contacted?
Do any customer contracts require notification?
Who communicates with employees?
Who communicates with customers?
How would we know the attacker was definitely out?
If those questions generate a lot of:
“I’m not sure.”
that’s useful information.
You can fix uncertainty before you have an incident.
Prevention is cheaper than investigation
No security system can guarantee that a business will never experience a cyber incident.
That’s not a realistic promise.
The objective is to reduce both the likelihood and the impact.
That means layers.
- Securely configured Microsoft 365.
- Multi-factor authentication.
- Email security.
- Endpoint protection.
- Threat monitoring.
- Controlled administrative access.
- Device management.
- Backups.
- Employee awareness.
- Appropriate policies.
- Incident-response planning.
- And people actually watching for suspicious activity.
Some controls prevent attacks.
Some detect them.
Some contain them.
Some help you recover.
Together, they reduce the chance that a relatively small security event turns into a major business problem.
Ask your IT company six questions
If you’re responsible for IT, ask your current provider:
- If one of our Microsoft 365 accounts was compromised tonight, how would you know?
- Who investigates security alerts when they occur?
- What information would we have available to determine what an attacker accessed?
- What would you do immediately to contain a compromised account or computer?
- What would you need from us during a serious incident?
- Do you help us plan for recovery, or only respond once something has happened?
The answers will tell you a lot about whether your IT is primarily reactive support or genuinely managed.
The attacker may be the smallest part of the bill
When businesses think about cybercrime, it’s natural to focus on the criminal.
How much did they steal?
How much ransom did they demand?
But sometimes the attacker doesn’t demand anything.
The real financial impact comes afterwards.
Investigation.
Downtime.
Management time.
Customer communication.
Professional advice.
Remediation.
Lost opportunities.
Damaged confidence.
And the work required to make sure it doesn’t happen again.
That’s why cybersecurity isn’t simply about protecting computers.
It’s about protecting the organisation that depends on them.
Would you know what to do?
Bitwise-IT provides managed IT and cybersecurity services to businesses across Essex and beyond.
Our approach combines preventative security, monitoring, employee awareness, backup and ongoing management because preventing an incident is only one part of cybersecurity.
Businesses also need to be able to detect, respond and recover.
If you’re responsible for IT and aren’t confident what would happen after a serious security incident, we’re happy to have a conversation.
Because the best time to work out your incident-response plan isn’t the morning you need it.
