What cyber incidents cost 17 companies: six measures, one insurance payout

01The bills surface for a year or more

Estimates come first and final figures last. Ahold Delhaize put a number on its October attack within a month; M&S’s full-year direct costs came 13 months after its attack; Co-op’s full-year figures came 11 months after its own, and were unaudited.³²⁶ Costs also keep running: Medibank booked A$34.9m in the year to June 2026, after A$39.7m the year before, for a 2022 attack, and has recognised no provision for the regulatory and class-action claims still open.¹⁰

02Six things a cost can mean, and who bears each

Lost sales, estimated by each company for itself: Co-op £285m in 2025 (its half-year estimate of £206m was set against its own pre-attack forecast), Ahold Delhaize €200–250m this quarter, Asahi about ¥5.0bn as a year-on-year fall in the third quarter of 2025.²²⁵³⁷ Owners bear it, and suppliers with them.

Operating profit, where lost margin meets one-off costs: M&S’s c.£300m, Co-op’s £107m (£86m of margin, £21m of costs), Ahold Delhaize’s €75–100m.²³⁴ Never add this to lost sales: Co-op’s £86m is the margin on its lost £285m, about 30% by our arithmetic, so the sum would count the same money twice.

Direct cost, what the response itself cost: system recovery, advisers and, at Asahi, written-off stock. The chart below converts each at one day’s rate so the bars compare.^86792101121 For scale, UnitedHealth counted US$2.2bn of direct response costs in 2024, and separately US$867m of lost revenue, at Change Healthcare.²³

Customer compensation goes back to the people affected: about US$1.2bn of Coupang vouchers, deducted from revenue as redeemed, and about Won 500bn of SK Telecom discounts and data.¹⁵

Fines are the regulator’s: about US$278m at Coupang, which says it will seek judicial relief, and Won 134.8bn at SK Telecom, which paid and has sued.¹⁵

Cash lost to fraud is a smaller and different event: seven Indian companies filed amounts from ₹1.50 crore to ₹33.39 crore, plus US$100,000 at Lancer’s UAE subsidiary, under SEBI’s disclosure rules.^{12131415161718} At Enviro Infra the two executive directors gave up their salaries until the loss is made good.¹⁴ We have written up Capillary and Spandana separately.

Every figure in the set, with the measure on each row:

03Insurers are rare, airlines are absent, and what to watch

Three measures, not netted off: M&S reports the £131.3m as an adjusting item and the £100.0m inside adjusted profit, booked in its first half.⁴⁶²⁴ In the documents we read, none of the other 16 companies reports money received from an insurer. Capillary has claimed under a crime policy and Spandana is filing a claim.¹²¹⁵ In our earlier Trend on US filers, insurers appear in five cases, as recoveries, retentions or a settlement they fund.²⁶

Outside estimates are a separate category. The UK’s Cyber Monitoring Centre modelled £1.9bn of loss (range £1.6bn to £2.1bn) across more than 5,000 UK organisations for JLR’s incident, most of it lost output at JLR and its suppliers, and £270–440m across parties affected by the M&S and Co-op disruption. Both are models, not company figures, and belong in neither the chart nor the table.¹⁹²⁰

Airlines. Amadeus’s review for the nine months to 30 September, published on 6 November, does not mention the breach, and the airlines’ notices began in October.²² They have counted affected passengers, not money, so far as we could find. Qantas booked A$15m for its own incident; the regulator’s preliminary enquiries reported no failings, a representative complaint remains open, and Qantas has recognised no provision for it.¹¹

What to watch. Whether Ahold Delhaize’s estimate holds at full-year results; Amadeus’s full-year accounts, the next place a figure could appear; and the Coupang and SK Telecom fines in the Korean courts, which could change what those fines end up costing.