---
title: "What cyber incidents cost 17 companies: six measures, one insurance payout"
summary: "What 17 companies in six countries say cyber incidents cost them, in their own reports from May 2025 to November 2026: six measures that cannot be added, and one insurance payout."
url: https://www.thetechbag.com/blog/cyberattack-costs-worldwide-company-reports
format: Trend
desk: "Security"
area: "Risk & compliance"
region: Global
published: 2026-11-09
facts_checked: 2026-11-09
author: TechBag (The TechBag Journal)
tags: ["cost of a cyberattack","cyber insurance","Marks & Spencer","Co-op","Jaguar Land Rover","Ahold Delhaize","Asahi","Askul","Coupang","SK Telecom","Medibank","Qantas","Amadeus","Capillary","Spandana Sphoorty","Cyber Monitoring Centre","operating profit","regulatory fines","SEBI Regulation 30","payment fraud"]
cover: https://www.thetechbag.com/blog/covers/cyberattack-costs-worldwide-company-reports.png
---

# What cyber incidents cost 17 companies: six measures, one insurance payout

*What 17 companies in six countries say cyber incidents cost them, in their own reports from May 2025 to November 2026: six measures that cannot be added, and one insurance payout.*

Trend · Security · Risk & compliance · By TechBag · Published 2026-11-09 · Facts checked 2026-11-09 · Canonical: https://www.thetechbag.com/blog/cyberattack-costs-worldwide-company-reports

The short version

1. Seventeen companies in six countries have put a money figure on a cyber incident in their own reports. The figures cannot be added: they measure six different things, from lost sales to stolen cash.
2. The largest single figure is Coupang’s US$1.2bn of customer vouchers, after a former employee reached customer accounts; the largest direct cost is JLR’s £196m, in one quarter. Only Marks & Spencer reports an insurance payout: £100.0m.[1][8][6]
3. We found no figure from any airline, or from Amadeus, for the Amadeus breach. Qantas’s A$15m is for its own July 2025 incident.[11][22]

A cost is not one number. In May 2025 M&S told investors to expect about £300m off operating profit, before mitigation and insurance. A year later it reported £131.3m of direct costs and, on a separate line, £100.0m of insurance.[4][6] Three measures, one company. This piece lines up what 17 companies have stated, by measure, and who bears each.

## The bills surface for a year or more

Estimates come first and final figures last. Ahold Delhaize put a number on its October attack within a month; M&S’s full-year direct costs came 13 months after its attack; Co-op’s full-year figures came 11 months after its own, and were unaudited.[3][2][6] Costs also keep running: Medibank booked A$34.9m in the year to June 2026, after A$39.7m the year before, for a 2022 attack, and has recognised no provision for the regulatory and class-action claims still open.[10]

**Figure: Companies' figures arrive piecemeal: M&S's full-year cost line came 13 months after its attack**

*When companies published a money figure for a cyber incident, May 2025 to November 2026 (selected)*

| Date | Event | Detail |
| --- | --- | --- |
| 21 May 2025 | M&S: c.£300m | expected operating-profit hit, before mitigation |
| 5 Nov 2025 | M&S: £100.0m | insurance proceeds, the only payout in the set |
| 14 Nov 2025 | JLR: £196m | cyber costs in one quarter |
| 26 Mar 2026 | Co-op: £285m / £107m | lost revenue / lost profit, estimated |
| 20 May 2026 | M&S: £131.3m | direct costs for the year |
| 27 Aug 2026 | Qantas: A$15m | response to its July 2025 incident |
| 3 Nov 2026 | Coupang: US$1.2bn / US$278m | vouchers / fine, in its 10-Q |
| 4 Nov 2026 | Ahold: €200–250m | estimated lost sales |

Source: Company reports and filings cited in the Sources below · as of 6 November 2026 · Eight of the dated figures; the full set is in the table

TechBag countHow we counted 17

Ten companies report a system attack or data incident: M&S, Co-op, JLR, Ahold Delhaize, Asahi, Askul, Coupang, SK Telecom, Medibank and Qantas. Seven Indian companies report cash stolen by fraud, a different thing from an outage. Coupang’s filing says a former employee accessed customer accounts, so it is an insider incident, not an outside attack.[1]

## Six things a cost can mean, and who bears each

**Lost sales**, estimated by each company for itself: Co-op £285m in 2025 (its half-year estimate of £206m was set against its own pre-attack forecast), Ahold Delhaize €200–250m this quarter, Asahi about ¥5.0bn as a year-on-year fall in the third quarter of 2025.[2][25][3][7] Owners bear it, and suppliers with them.

**Operating profit**, where lost margin meets one-off costs: M&S’s c.£300m, Co-op’s £107m (£86m of margin, £21m of costs), Ahold Delhaize’s €75–100m.[2][3][4] Never add this to lost sales: Co-op’s £86m is the margin on its lost £285m, about 30% by our arithmetic, so the sum would count the same money twice.

**Direct cost**, what the response itself cost: system recovery, advisers and, at Asahi, written-off stock. The chart below converts each at one day’s rate so the bars compare.[8][6][7][9][2][10][11][21] For scale, UnitedHealth counted US$2.2bn of direct response costs in 2024, and separately US$867m of lost revenue, at Change Healthcare.[23]

**Customer compensation** goes back to the people affected: about US$1.2bn of Coupang vouchers, deducted from revenue as redeemed, and about Won 500bn of SK Telecom discounts and data.[1][5]

**Fines** are the regulator’s: about US$278m at Coupang, which says it will seek judicial relief, and Won 134.8bn at SK Telecom, which paid and has sued.[1][5]

**Cash lost to fraud** is a smaller and different event: seven Indian companies filed amounts from ₹1.50 crore to ₹33.39 crore, plus US$100,000 at Lancer’s UAE subsidiary, under SEBI’s disclosure rules.[12][13][14][15][16][17][18] At Enviro Infra the two executive directors gave up their salaries until the loss is made good.[14] We have written up [Capillary](https://www.thetechbag.com/blog/capillary-czech-arm-3-04m-euros-impostors) and [Spandana](https://www.thetechbag.com/blog/spandana-sphoorty-7-80-crore-cyber-fraud) separately.

**Figure: JLR's one-quarter bill tops the direct costs; the one airline in the set, Qantas, booked A$15m**

*Direct response and recovery cost as each company states it, converted to US$ million at one day's rate; periods differ*

JLR

£196m, one quarter

262 US$m

M&S

£131.3m, one year

176 US$m

Asahi

¥17.0bn, includes stock written off

107 US$m

Askul

¥6,377m, two lines

40 US$m

Co-op

£21m

28 US$m

Medibank

A$34.9m, year four of a 2022 attack

24 US$m

Qantas

A$15m

10 US$m

|  | Value (US$m) |
| --- | --- |
| JLR | 262 |
| M&S | 176 |
| Asahi | 107 |
| Askul | 40 |
| Co-op | 28 |
| Medibank | 24 |
| Qantas | 10 |

Source: Company reports; ECB euro reference rates of 6 November 2026; TechBag conversion · as of 6 November 2026 · One day's rate for every row, not the rate when each cost was booked. Co-op's £21m sits inside its £107m

Every figure in the set, with the measure on each row:

| Measure | Company | Figure as stated | Period |
| --- | --- | --- | --- |
| Lost sales | Co-op (UK) | £285m, estimated | 2025 |
| Lost sales | Ahold Delhaize (Netherlands) | €200–250m, estimated | Q4 2026 |
| Lost sales | Asahi (Japan) | about ¥5.0bn, estimated | Q3 2025 |
| Operating profit | M&S (UK) | c.£300m, before mitigation | 2025/26 |
| Operating profit | Co-op (UK) | £107m | 2025 |
| Operating profit | Ahold Delhaize (Netherlands) | €75–100m, estimated | Q4 2026 |
| Direct cost | JLR (UK) | £196m | Quarter to Sept 2025 |
| Direct cost | M&S (UK) | £131.3m | Year to March 2026 |
| Direct cost | Asahi (Japan) | ¥17.0bn, with stock written off | 2025 |
| Direct cost | Askul (Japan) | ¥5,108m + ¥1,269m | Year to May 2026 |
| Direct cost | Co-op (UK) | £21m, inside the £107m | 2025 |
| Direct cost | Medibank (Australia) | A$34.9m, for a 2022 attack | Year to June 2026 |
| Direct cost | Qantas (Australia) | A$15m | Year to June 2026 |
| Compensation | Coupang (South Korea) | about US$1.2bn of vouchers | From January 2026 |
| Compensation | SK Telecom (South Korea) | about Won 500bn | Second half 2025 |
| Fine | Coupang (South Korea) | about US$278m, subject to judicial review | June 2026 |
| Fine | SK Telecom (South Korea) | Won 134.8bn, paid, suit filed | August 2025 |
| Insurance received | M&S (UK) | £100.0m | First half 2025/26 |
| Cash lost to fraud | Capillary (India) | ₹33.39 crore | Quarter to June 2026 |
| Cash lost to fraud | Western Capital (India) | ₹18.96 crore | October 2026 |
| Cash lost to fraud | Enviro Infra (India) | ₹11.15 crore | June–July 2025 |
| Cash lost to fraud | Spandana Sphoorty (India) | ₹7.80 crore | November 2026 |
| Cash lost to fraud | SG Finserve (India) | ₹5.10 crore | November 2026 |
| Cash lost to fraud | NeoChem (India) | ₹1.50 crore | July 2026 |
| Cash lost to fraud | Lancer (India; UAE arm) | US$100,000 | November 2026 |

## Insurers are rare, airlines are absent, and what to watch

c.£300m

M&S's expected profit hit, before mitigation and insurance

May 2025

£131.3m

M&S's direct costs, an adjusting item

Year to March 2026

£100.0m

Insurance received, in adjusted profit

First half 2025/26

Three measures, not netted off: M&S reports the £131.3m as an adjusting item and the £100.0m inside adjusted profit, booked in its first half.[4][6][24] In the documents we read, none of the other 16 companies reports money received from an insurer. Capillary has claimed under a crime policy and Spandana is filing a claim.[12][15] In our [earlier Trend on US filers](https://www.thetechbag.com/blog/cyberattack-costs-in-company-filings), insurers appear in five cases, as recoveries, retentions or a settlement they fund.[26]

**Outside estimates are a separate category.** The UK’s Cyber Monitoring Centre modelled £1.9bn of loss (range £1.6bn to £2.1bn) across more than 5,000 UK organisations for JLR’s incident, most of it lost output at JLR and its suppliers, and £270–440m across parties affected by the M&S and Co-op disruption. Both are models, not company figures, and belong in neither the chart nor the table.[19][20]

**Airlines.** Amadeus’s review for the nine months to 30 September, published on 6 November, does not mention the breach, and the airlines’ notices began in October.[22] They have counted [affected passengers](https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier), not money, so far as we could find. Qantas booked A$15m for its own incident; the regulator’s preliminary enquiries reported no failings, a representative complaint remains open, and Qantas has recognised no provision for it.[11]

**What to watch.** Whether [Ahold Delhaize’s estimate](https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros) holds at full-year results; Amadeus’s full-year accounts, the next place a figure could appear; and the Coupang and SK Telecom fines in the Korean courts, which could change what those fines end up costing.

In India, the filings measure stolen cash, not outages

All seven Indian cases here are cash lost to fraud, disclosed under SEBI’s listing rules; four of the filings are dated in the past five weeks, by our count.[13][15][16][18] None of the Indian companies in the set puts a rupee figure on a system outage; JLR’s Indian-listed parent reports a line that mixes supplier claims with cyber costs, which we leave out.[27] Five of the seven filings mention no insurance claim. A finance team reading them can ask which of these six measures its own policy pays for.

How we did this

Figures as of 9 November 2026, 7pm IST

Every company figure was read in its own report or filing. Direct costs are converted at the ECB euro reference rates of 6 November 2026 (US$1.1165, £0.83415, ¥176.77 and A$1.625 to the euro), one day’s rate for every row and not the rate when each cost was booked. Askul’s bar adds its ¥5,108m system-failure line and ¥1,269m of depreciation on idle assets, both tied by Askul to the failure. We add nothing across measures and name no attacker. Regions: we found no company-stated figure in the Gulf, Singapore or Hong Kong; Germany and France were not checked filing by filing; airlines beyond those above were not opened one by one.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Coupang, Form 10-Q](https://www.sec.gov/Archives/edgar/data/1834584/000183458426000086/cpng-20260930.htm) — 3 November 2026
2. [Co-op, 2025 Trading Statement](https://assets.ctfassets.net/5ywmq66472jr/59nTaDxCUtvRxKWZzPGHoX/a6cc7d4463c0054dc6ce9432e5497049/Co-op_2025_Trading_Statement.pdf) — 26 March 2026
3. [Ahold Delhaize, Q3 2026 results](https://newsroom.aholddelhaize.com/ahold-delhaize-reports-resilient-q3-2026-results-and-updates-2026-guidance-to-reflect-business-disruption-caused-by-recent-cybersecurity-incident/) — 4 November 2026
4. [M&S, FY24/25 results](https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf) — 21 May 2025
5. [SK Telecom, Form 20-F for 2025](https://www.sec.gov/Archives/edgar/data/1015650/000119312526188763/d78252d20f.htm) — 29 April 2026
6. [M&S, FY25/26 results (with insurance line first reported 5 November 2025)](https://corporate.marksandspencer.com/sites/marksandspencer/files/2026-05/fy26-rns.pdf) — 20 May 2026
7. [Asahi Group, Integrated Report 2026, p.8](https://s3-ap-northeast-1.amazonaws.com/asahigroup-doc/company/policies-and-report/pdf/en/2026_integrated_report.pdf) — 2026
8. [JLR, Q2 FY26 results](https://media.jlr.com/corporate/news/2025/11/jlr-performance-impacted-challenging-quarter) — 14 November 2025
9. [Askul, results for the year to May 2026](https://www2.jpx.co.jp/disc/26780/140120260703587650.pdf) — 3 July 2026
10. [Medibank, Annual Report 2026](https://www.medibank.com.au/content/dam/retail/about-assets/pdfs/investor-centre/annual-reports/Medibank_Group_%20Annual_Report_2026.pdf) — 20 August 2026
11. [Qantas, Annual Report 2026](https://investor.qantas.com/FormBuilder/_Resource/_module/doLLG5ufYkCyEPjF1tpgyw/file/annual-reports/2026-Annual-Report.pdf) — 27 August 2026
12. [Capillary, Q1 FY27 results](https://nsearchives.nseindia.com/corporate/CAPILLARY12_04082026132740_outcome_of_Board_meeting_and_results.pdf) — 4 August 2026
13. [Western Capital, Regulation 51 filing](https://nsearchives.nseindia.com/content/debt/WDM/WCAPLcompliance_10102026112503_Intimationo_of_cyber_fraud.pdf) — 10 October 2026
14. [Enviro Infra, Regulation 30 filing](https://nsearchives.nseindia.com/corporate/ENVIRO_02072025193048_Intimation_of_fraud.pdf) — 2 July 2025
15. [Spandana Sphoorty, Regulation 30 filing](https://nsearchives.nseindia.com/corporate/SPANDANA_02112026105300_SEcyberfraud.pdf) — 2 November 2026
16. [SG Finserve, Regulation 30 filing](https://nsearchives.nseindia.com/corporate/SGFINSERVE_03112026181926_Toupload.pdf) — 3 November 2026
17. [NeoChem, Regulation 30 filing](https://nsearchives.nseindia.com/corporate/NEOCHEM_22072026181207_NSE_Reg30_Intimation_Neochem.pdf) — 22 July 2026
18. [Lancer Container Lines, Regulation 30 filing](https://nsearchives.nseindia.com/corporate/LANCER_06112026203246_CyberfraudLancia.pdf) — 6 November 2026
19. [Cyber Monitoring Centre, JLR statement](https://cybermonitoringcentre.com/2025/10/22/cyber-monitoring-centre-statement-on-the-jaguar-land-rovercyber-incident-october-2025/) — 22 October 2025
20. [Cyber Monitoring Centre, retail statement](https://cybermonitoringcentre.com/2025/06/20/cyber-monitoring-centre-statement-on-ransomware-incidents-in-the-retail-sector-june-2025/) — 20 June 2025
21. [European Central Bank, euro reference rates](https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html) — 6 November 2026
22. [Amadeus, management review, January to September 2026](https://amadeus.com/content/dam/amadeus/corporate/documents/en/investors/2026/results/q3/q3-2026-management-review.pdf) — 6 November 2026
23. [UnitedHealth Group, Form 10-K for 2024](https://www.sec.gov/Archives/edgar/data/731766/000073176625000063/unh-20241231.htm) — 27 February 2025
24. [M&S, H1 2025/26 results](https://corporate.marksandspencer.com/sites/marksandspencer/files/2025-11/marks-and-spencer-hy-2526-rns.pdf) — 5 November 2025
25. [Co-op, Interim Results 2025](https://assets.ctfassets.net/5ywmq66472jr/inQbpqZKZA34xlGz3t2Pu/51ff10a1def9367c28ee0fc1a9bf979a/Co-op_Interim_Results_2025.pdf) — 25 September 2025
26. [The TechBag Journal: What cyberattacks cost, as filed](https://www.thetechbag.com/blog/cyberattack-costs-in-company-filings) — 7 November 2026
27. [Tata Motors Passenger Vehicles, FY26 results, note on exceptional items](https://nsearchives.nseindia.com/corporate/TATAMOTORSSJS_14052026162456_FINAL.pdf) — 14 May 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Amadeus breach hit at least ten airlines through one booking system](https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier) — The airlines' side of the story: how one booking supplier exposed records at ten airlines, what was read, and why the counts cannot be added.

Go deeper on TechBag

- [Cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — restoring systems from a clean copy, the work behind most of the direct costs here
- [Managed detection and response guide](https://www.thetechbag.com/browse/security/managed-detection-response) — outside teams that find an intrusion early and help contain it
- [Email security guide](https://www.thetechbag.com/browse/security/email-security) — the filters that catch the impersonation behind several of the fraud filings