The cost of a cyberattack extends far beyond any immediate mitigation expenses or ransoms paid.
Reputational costs and dipping stock values can be a significant portion of losses, according to the new Aon Global 20
25 Cyber Risk Report. Reputation risk events can cause shareholder value to fall by an average of 27%, according to Aon — and reputation risks are nontransferable.
The Growing Cyberattack Severity
In 2024, the frequency of reported cyber incidents was up 22% on the previous year. The 776 reported cyber inci
dents or litigation representing the most claims, an increase of 31% year over year, ranging from ransomware and business interruption to class action litigation
and regulatory investigations. In the U.S., for example, Aon
cyber and errors and omissions (E&O) claims data revealed 1,228
reported incidents across broking clients in 2024, reflecting an increase of 22% year over year.
While ransomware claims frequency increased, the average ransom payment amount for Aon broking clients declined by 77%. Midsized organizations file
d more cyber claims than any other group—over half of all incidents.
Reputation Risk Factors
See more beautiful photo albums Here >>>
Damage to brand or reputation is a top risk facing organizations glob
ally today, according to Aon's latest Global Risk Management Survey (GRMS) and has been one since 2007.
Specific cyberattack techniques are more likely to become reputation risk events than others, the Aon report states
d. Malware/ransomware attacks make up a disproportionate number of the identified reputation risk events, a
ccounting for approximately 60% of reputation risk cyber events but only 45% of all cyber events.
Malware attacks are the most common (57% of all) and have a high propensity to have a reputational impact (20% likelihood) and a high impact (-28% on av
age). A system exploits attack, in comparison, has just an 8% chance of reputational impact.
For cyber events, there is also a likely large-scale media pickup when there are opportunities for consumers impact or outrage or issues that could be considered to be in the public interest. The Aon report analyzed 1,414 cyber events reported in the media up to the end of 2024, of which more than 95% were malicious. Of the 1,414 cyber events, analysis showed that 56 developed into reputation risk events, causing shareholder value to fall by 27%.