Overcoming the Reputational Cost of Cyber Attacks: The 10-Day Plan

Overcoming the Reputational Cost of Cyber Attacks: The 10-Day Plan
Technology

08 of 11

This insight is part 08 of 11 in this Collection.

September 25, 2023 9 mins

Overcoming the Reputational Cost of Cyber Attacks: The 10-Day Plan

Overcoming the Reputational Cost of Cyber Attacks: The 10-Day Plan

The first 10 days after a cyber-attack can be the most damaging. Having a cyber incident response plan in place and ready to deploy can help companies assess threats and develop controls.

Key Takeaways
  1. Taking charge by following clear steps after a cyber event within the first 10 days can help manage a company’s reputational damage.
  2. According to Aon’s 2023 Cyber Resilience Report, nearly 70 percent of overall loss is incurred during the first 10 days in the form of direct losses and cost of management and recovery.
  3. Proactive governance and risk management strategies are crucial to maintain a strong position in the 90 days to follow.

Political and business leaders often have a 100-day plan to make an impact in their roles, but cyber events present a different set of challenges. Instead, it is the first 10 days that count based on our experience.

Day 10 vs. Day 100

The first 10 days after a cyber-attack is crucial for effective crisis management.

  • Most Damage

    66% of this ultimate loss was incurred at 10 days illustrating how the majority of the damage occurred immediately after the event and that any remediation steps taken in the first 10 days will have much greater financial benefits than more delayed actions.

    Day 10 vs Day 100 - Most damage chart_acc1_1
  • Immediate Impact

    Immediate impact stems from direct losses and cost of management and recovery.

    Day 10 vs Day 100 - Long-term impact chart_acc1_2
  • Long-term Impact

    57% of those deemed losers after day 10 remain losers at day 100 which emphasises the importance of acting quickly in the crisis management post event.

    acc1_3
  • Average Loss

    Companies that are ineffective in post-event crisis management have on average suffered 29% more damage compared to the better prepared ones by day 100. Average loss of shareholder value after 100 days was about US$3B.

    Day 10 vs Day 100 - Average Loss chart_acc1_4

Source: 2023 Cyber Resilience Report

“Any remediation steps during the first 10 days post-event should have much greater financial benefits than delayed actions,” says Martin McGovern, Director for Aon’s Actuarial and Data Science practice. “Rapid and effective crisis management can help dampen the potential financial severity of these events and reduce potential catastrophic losses.”

The 10-Day Plan

The 10-Day Plan Having a cyber incident response plan in place and ready to deploy helps affected companies take more proactive steps and make better decisions during a crisis, rather than react in panic mode.

The plan should establish checklists, roles and responsibilities, and a direct line of communication between frontline representatives, responsible persons and decision makers. There should be at least one responsible person from crucial departments, including legal and compliance, communications and PR, finance, HR and customer service.

To be well-positioned for success in the first 10 days of a cyber triggered reputational crisis, businesses can take the following steps.

Assess

Understand the potential reputational impact (from customers, regulators or markets) associated with the first 10 days following a cyber-attack. These insights should better inform critical crisis management and incident response decisions to mitigate reputational harm during this time-sensitive period.

Mitigate

Determine current levels of crisis management, business continuity and incident response readiness and develop appropriate action plans. Ensure that the right resources are in place across operational, legal, communications and threat monitoring capabilities to respond in a timely manner during the first 10 days of an event.

Transfer

Investigate what insurances are in place and ensure understanding of when and how to notify and cooperate with the insurer to best use existing cover. Based on the analysis of reputational exposures during the ASSESS stage, ensure that insurance limits can adequately fund these external resources. Check that notification protocols and service agreements with these vendors are already in place.

Respond

Frequently test the crisis management and incident response plans for a cyber attack. Run cross-team tabletop exercises that involve key vendors and external partners. This will not only improve organizational preparedness, but also give comfort to critical stakeholders, including financial regulators. It’s important to ensure appropriate governance and risk management practices are being adopted to safeguard shareholders such as:

  • Rapid incident response with clear and appropriate communications
  • Implementation of a strong infrastructure to predict and prevent future events
  • Establish clear and consistent insurance and claims protocols
  • Investment in tools to monitor the landscape

“Businesses that plan for, and anticipate, reputational crises and therefore can communicate in a genuine manner, may find that the market not only can forgive, but may also reward those who respond effectively,” says Adam Peckman, Aon’s Global Head of Cyber Risk Consulting and Head of Cyber Solutions in APAC.

Quote icon

Businesses that plan for, and anticipate, reputational crises and therefore can communicate in a genuine manner, may find that the market not only can forgive, but may also reward those who respond effectively”

Adam Peckman
Head of Cyber Solutions, Asia-Pacific

Cyber Governance for Stronger Reputation

While the first 10 days are crucial, it is still important to maintain a strong position in the 90 days to follow. Important governance and risk management strategies include:

Operational response
  • Invoke a business continuity plan: If critical revenue streams or customer services are disrupted, an alternative operating strategy should be implemented to help mitigate the loss. Due to the ubiquity of digital technology across supply chains and production networks, cyber attacks can create systemic disruption. It is critical that these digital disruptions are factored into business continuity programs to minimize the resulting reputational harm from impacted customers and vendors.
  • Find and isolate the breach: Starting with the company’s known vulnerabilities and most critical assets, identify the device or network where the breach occurred, and then isolate the threat to better limit additional damage. Instruct the rest of the company on what IT security actions need to be taken.
  • Accurately identify the problem: Assess the scope of damage to refine the company’s operational and technology response. Make sure the right stakeholders are brought in, the right notifications are made and that all communications are properly managed. This includes customers, impacted data subjects and appropriate regulators. Accuracy is paramount. Being forced to recant or change a previous statement can damage credibility and turn the incident into a PR crisis.
  • Clean up and restore systems: Retrace the attack to reveal compromised data and determine the date the breach took place. Identify the most recent clean backups, and restore or rebuild the system, network and data to their pre-incident state.
  • Remediate cybersecurity gaps: Use the information to strengthen security protocols, refine policies, update response plans and further educate staff and key partners
Communication response
  • Management: Reassure stakeholders and outline a plan to make things right. Identify opportunities to create value.
  • Legal: Report the incident according to relevant laws and regulations, including duty of disclosure requirements for privacy or financial market regulations, listed companies and law enforcement bodies at the local and international levels. Notify partners according to obligations in key contracts.
  • Risk management: Understand all notification obligations and appropriate reporting protocols. Develop a notification plan with the appropriate insurance broker or other insurance professional that considers timing, information requirements and involvement of external partners — such as legal guidance, incident response and claims preparation.
  • Communications and PR: Determine the affected parties and use communication templates to notify them through predetermined channels and according to the predetermined schedule. If the news cannot be contained, issue a timely statement to the public to gain control over the narrative. External communication advice may be helpful for determining whether to shift strategy or change messaging.
  • HR and customer service: Address employee and customer concerns, especially if their data was stolen.

“Companies can use the abovementioned tools to respond swiftly and effectively during cyber crises, seizing the opportunity to control the reputational narrative and minimize damage to their overall brand,” says Christian Hoffman, Aon’s CEO for Cyber Solutions in North America.

Better Decisions for Better Results

Case Study 1: Delayed Action Disrupts UK Telco TalkTalk
  • Event
    • Website down due to “technical issues”, i.e., a cyber attack
    • 4 million customers initially feared impacted
    • 16 days later, 157,000 customers confirmed affected
  • Immediate Post-Crisis Result

    • US$60-70M in exceptional costs
    • Loss of customer trust derails growth plans

  • Response
    • Well-intentioned communications, but issued piecemeal
    • CEO apology video released 2 days after attack became public
    • Technical coherence sometimes lacking, undermining credibility
    • Underestimated time to return to operational effectiveness
  • End of Post-Crisis Year Result
    • One-third of shareholder value lost (approximately US$1.4B)
    • Trading revenue cut by over US$20M
    • 101,000 customers lost
  • Lessons

    • Test the plan regularly
    • Match response to the evidence
    • Expect scrutiny and be technically coherent
    • Respond immediately, or others will

Case Study 2: U.S. retailer Home Depot Unlocks Value in Adversity
Home Depot chart_acc3
  • Event

    • Security breach of payment card systems
    • Malware was custom-made to avoid detection
    • 56 million debit and credit cardholders compromised

  • Immediate Post-Crisis Result

    • US$10B in losses
    • The largest data breach of its kind

  • Response

    • Chairman’s response was immediate, unwavering and empathetic
    • Incident Response Plan activated
    • Free credit monitoring, retired affected terminals, eliminated malware
    • Enhanced encryption technology rolled out

  • End of Post-Crisis Year Result
    • Shareholder value climbed 25 percent (over US$30B)
  • Lessons

    • Respect the fears of customers
    • Prevention is better than cure
    • Rise to the occasion and make things right
    • Respond instantly with a clear focus

Source: Reputation Risk in the Cyber Age

Quote icon

Any remediation steps during the first 10 days post-event should have much greater financial benefits than delayed actions”

Martin McGovern
Director for Aon’s Actuarial and Data Science Practice
Authors
  • Richard Waterer
    Global Risk Consulting Leader, Commercial Risk Solutions
  • Jason Disborough
    CEO of Multinational Clients (International), Enterprise Client Leader, Aon
  • Martin McGovern
    Director for Aon’s Actuarial and Data Science Practice
  • Adam Peckman
    Head of Cyber Solutions, Asia-Pacific
  • Christian Hoffman
    Global Cyber Leader

General Disclaimer

Aon is not a law firm or accounting firm and does not provide legal, financial or tax advice. Any commentary provided is based solely on Aon’s experience as insurance practitioners. We recommend that you consult with your own legal, financial and/or insurance advisors on any commentary provided herein. All descriptions, summaries or highlights of coverage described herein are for general informational purposes only and do not amend, alter of modify the actual terms and conditions of any relevant policy. Coverage is governed only by the terms and conditions of such policy. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details. The information contained in this document and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity. Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the article or any part of it and can accept no liability for any loss incurred in any way whatsoever by any person who may rely on it.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

Aon's Better Being Podcast

Our Better Being podcast series, hosted by Aon Chief Wellbeing Officer Rachel Fellowes, explores wellbeing strategies and resilience. This season we cover human sustainability, kindness in the workplace, how to measure wellbeing, managing grief and more.

Aon Insights Series Asia

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series Pacific

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series UK

Expert Views on Today's Risk Capital and Human Capital Issues

Construction and Infrastructure

The construction industry is under pressure from interconnected risks and notable macroeconomic developments. Learn how your organization can benefit from construction insurance and risk management.

Cyber Labs

Stay in the loop on today's most pressing cyber security matters.

Cyber Resilience

Our Cyber Resilience collection gives you access to Aon’s latest insights on the evolving landscape of cyber threats and risk mitigation measures. Reach out to our experts to discuss how to make the right decisions to strengthen your organization’s cyber resilience.

Employee Wellbeing

Our Employee Wellbeing collection gives you access to the latest insights from Aon's human capital team. You can also reach out to the team at any time for assistance with your employee wellbeing needs.

Environmental, Social and Governance Insights

Explore Aon's latest environmental social and governance (ESG) insights.

Q4 2023 Global Insurance Market Insights

Our Global Insurance Market Insights highlight insurance market trends across pricing, capacity, underwriting, limits, deductibles and coverages.

Regional Results

How do the top risks on business leaders’ minds differ by region and how can these risks be mitigated? Explore the regional results to learn more.

Human Capital Analytics

Our Human Capital Analytics collection gives you access to the latest insights from Aon's human capital team. Contact us to learn how Aon’s analytics capabilities helps organizations make better workforce decisions.

Insights for HR

Explore our hand-picked insights for human resources professionals.

Workforce

Our Workforce Collection provides access to the latest insights from Aon’s Human Capital team on topics ranging from health and benefits, retirement and talent practices. You can reach out to our team at any time to learn how we can help address emerging workforce challenges.

Mergers and Acquisitions

Our Mergers and Acquisitions (M&A) collection gives you access to the latest insights from Aon's thought leaders to help dealmakers make better decisions. Explore our latest insights and reach out to the team at any time for assistance with transaction challenges and opportunities.

Navigating Volatility

How do businesses navigate their way through new forms of volatility and make decisions that protect and grow their organizations?

Parametric Insurance

Our Parametric Insurance Collection provides ways your organization can benefit from this simple, straightforward and fast-paying risk transfer solution. Reach out to learn how we can help you make better decisions to manage your catastrophe exposures and near-term volatility.

Pay Transparency and Equity

Our Pay Transparency and Equity collection gives you access to the latest insights from Aon's human capital team on topics ranging from pay equity to diversity, equity and inclusion. Contact us to learn how we can help your organization address these issues.

Property Risk Management

Forecasters are predicting an extremely active 2024 Atlantic hurricane season. Take measures to build resilience to mitigate risk for hurricane-prone properties.

Technology

Our Technology Collection provides access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities of technology. Reach out to the team to learn how we can help you use technology to make better decisions for the future.

Top 10 Global Risks

Trade, technology, weather and workforce stability are the central forces in today’s risk landscape.

Trade

Our Trade Collection gives you access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities for international business. Reach out to our team to understand how to make better decisions around macro trends and why they matter to businesses.

Weather

With a changing climate, organizations in all sectors will need to protect their people and physical assets, reduce their carbon footprint, and invest in new solutions to thrive. Our Weather Collection provides you with critical insights to be prepared.

Workforce Resilience

Our Workforce Resilience collection gives you access to the latest insights from Aon's Human Capital team. You can reach out to the team at any time for questions about how we can assess gaps and help build a more resilience workforce.

More Like This

View All