FREE TOOL
What would a ransomware attack cost your business per day?
Enter how many staff can’t work, your loaded hourly cost, how many days you’d be down, and the one-off recovery and legal costs. This free tool adds them up into a cost per day and a total, using your own numbers rather than an industry average that may not fit your business.
Salary, social charges and overhead together, not just gross pay.
Orders you can’t take, a shop or site that’s down. Leave at 0 if only staff cost counts.
What this incident would cost
Cost per day
€3,600
Total for 5
€38,000
The formula: Cost per day = staff × hourly cost × hours idle + lost revenue per day. Total = cost per day × days down + IT recovery + notification and legal costs.
How this compares to a NIS2 fine
A NIS2 fine is a separate, additional cost on top of this, not instead of it. See the highest fine the law allows for your company.
Open the NIS2 fine calculator →How is the cost of ransomware downtime calculated?
There is no single euro figure for "what ransomware costs an SME". It depends on how many people it stops from working, how long your systems stay down, and whether you lose sales meanwhile. This tool adds four parts into one number:
- Staff cost while idle: the people who can’t do their job, times what each costs you per hour, times the hours a day they’re stuck.
- Lost revenue per day: orders you can’t take or a shop or site that’s down, if that applies to you.
- IT recovery, one-off: rebuilding or restoring systems, often with outside help.
- Notification and legal, one-off: telling the people the incident affects, plus the legal work around it. Both the Belgian NIS2 law and the GDPR create a duty here, so it is a real cost [3][4].
IBM’s 2026 Cost of a Data Breach Report put the average time to spot and contain a breach at 247 days [1]. That is how long the whole incident runs, not how many days your systems are down. Downtime is usually shorter, but rarely a single day. The CCB says CyberFundamentals Basic protects against known cybersecurity risks [2], and that is the cheaper number to aim for.
See also the cyber insurance readiness check and the incident reporting clock.
What does a realistic Belgian SME example look like?
A 20-person company loses its file server and email to ransomware. 12 people can’t work at all for 4 days. The owner estimates a loaded cost of 40 EUR/hour per person, no direct lost sales, 12,000 EUR to rebuild with outside IT help, and 4,000 EUR in notification and legal work.
Cost per day: 12 × 40 × 8 = 3,840 EUR. Total: 3,840 × 4 + 12,000 + 4,000 = 31,360 EUR. Change the numbers above to match your own company and see your own total.
An attack usually starts with a link or attachment: see the page on ransomware and the phishing page. To check whether the NIS2 directive in Belgium applies to your company, or what What is CyberFundamentals (CyFun) covers, those pages explain it.
Want to actually rehearse this with a team? The free Tabletop Exercise Kit has a ransomware scenario with facilitator notes, ready to run.
Frequently asked questions
- Is this an official number an insurer or court would use?
- No. It is a planning tool for your own business case, built from your own estimates. An insurer, broker or court works from its own figures and evidence, not from a free online calculator.
- Why is there no default figure for how many days we’d be down?
- Because it depends on whether you have tested, offline backups, how complex your systems are, and whether you rebuild yourself or call in help. Enter your best estimate, or ask your IT partner for theirs.
- What goes in "lost revenue per day"?
- Orders you can’t take, a till or webshop that’s down, work you can’t bill for. Leave it at 0 if your main cost is staff standing idle rather than missed sales.
- Does this include paying the ransom?
- No, deliberately. Paying or not paying is a separate decision with its own risks, and it does not guarantee your data comes back. This tool prices the downtime and recovery, which you face either way.
- How does this relate to a NIS2 fine?
- They are separate, and they add up. A NIS2 fine, where it applies, comes on top of the downtime cost calculated here, not instead of it. Use the NIS2 fine calculator to see the range for your company.
Related free tools
- NIS2 fine calculator Pick what the Belgian NIS2 law makes your company and enter your group turnover. See the highest fine it allows.
- Cyber insurance readiness check The controls insurers commonly ask about: MFA, backups, EDR, patching, training, an incident plan. See your likely gaps, mapped to CyFun controls.
- Incident reporting clock Enter when you found out about a cyber incident. Get every Belgian NIS2 reporting deadline to the CCB, plus the GDPR 72-hour deadline, to the minute.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/ransomware-downtime-cost/, by Easy Cyber Protection.
#CYBERLEARN