Information Risk Insights Study: Xtreme Edition, 2020
The 2020 IRIS Xtreme examines the largest cyber loss events of 2015 to 2019 to see what they cost, who caused them and how they happened. The median event in this set cost $47M, and five topped $1B. Together the 103 events represent $18 billion in reported losses.
Extreme events tend to get treated as unforeseeable acts of fate, and the data argues otherwise. The same basics that drive ordinary incidents (stolen credentials, backdoors, unpatched known vulnerabilities) drive most of these too. State-affiliated actors stand out, behind one in five events and a large share of the losses, and a single campaign, NotPetya, accounts for nearly a fifth of all losses. Insider misuse, often called the biggest threat, barely appears. How a firm responds also matters, since events with signs of a botched response cost much more. And while large enterprises suffer most of these events, the hardest hits relative to revenue fall on smaller firms. For boards, these events are a planning problem for insurance, reserves and response, not just a technical one.
The full report breaks down losses by form (response, productivity, fines), looks at non-financial impacts such as executive churn and government inquiries, and examines how these events appear in SEC filings. It ranks incident patterns, threat actors and VERIS threat actions, and closes with guidance on discussing extreme events with the board.
Key Findings
- $47M Median Loss: The median extreme event cost $47M; just over one in four exceeded $100M, and five reached $1B or more.
- 2.8x Cost of Poor Response: Events with signs of a botched response had median losses of $109M, versus $39M where no such signs appeared.
- State Actors, 43% of Losses: State-affiliated groups were behind one in five extreme events and $7.8B (43%) of known losses.
- NotPetya, 20% of Losses: A single campaign, NotPetya, accounts for $3.5B, nearly 20% of all losses in the study.
- Credentials Lead Again: Credential attacks appeared in 46 of the 103 events, more than any other threat action, and tie to $10B in losses.
- Known CVEs, $8B: Exploits of known, patchable vulnerabilities appeared in 22 events but rank third in total losses at about $8B.
- 3x Losses in SEC Filings: Median losses for events mentioned in SEC filings were $94M, three times the $31M for other public firms’ extreme events.
Independent analysis by Cyentia Institute, with support from VisibleRisk, of 103 extreme cyber events from 2015 through 2019 in Advisen’s Cyber Loss Data, each researched from public sources.
Key Risk Insight
Extreme cyber losses come mostly from familiar weaknesses and well-resourced attackers rather than freak events, and a poor response can multiply the cost. Boards should test insurance, reserves and response plans against losses of this size.
Cite this report: Cyentia Institute (2020). Information Risk Insights Study: Xtreme Edition, 2020. https://www.cyentia.com/publication/iris-xtreme/
Figure 2: Distribution of extreme cyber event losses by overall magnitude. The median extreme event cost $47M, just over one in four exceeded $100M, and five reached $1B or more. 
Figure 9: Comparison of total losses for events involving a poor response. Events with signs of a botched response cost nearly 2.8 times as much, so response readiness affects the size of the loss, not just recovery time. 
Figure 17: Total losses for extreme cyber events attributed to state-affiliated and organized criminal groups. State-affiliated actors were behind one in five of these events but caused $7.8B, 43% of all known losses. 
Table 3: Losses associated with major campaigns. A single campaign, NotPetya, accounts for about a fifth of all losses among these 103 extreme events. 
Figure 19: Count and total losses for top 10 threat actions identified in extreme cyber events. Stolen credentials and exploits of known vulnerabilities, both familiar problems, sit behind a large share of these losses. 
Figure 13: Comparison of losses for cyber events reported in SEC filings vs. not reported. Events mentioned in SEC filings had median losses three times higher, consistent with materiality rules flagging the larger losses.
Get exclusive content, sector-specific updates, and expert commentary
Testimonials
Need an IRIS Focused on Your Organization?
That’s exactly what our Retina risk intelligence service provides. You get a report on key cyber risk factors for your peer group, along with monthly data and analysis to monitor prevailing trends.