Understanding Ransomware Through the Lens of Disaster Risk: Implications for Cybersecurity and Economic Stability

1. Introduction

In the current digital economy, over 60 percent of commercial transactions occur online, exposing cyberspace to vulnerabilities and necessitating high-quality security for optimal, transparent transactions (Valackienė & Odejayi, 2024). Insights from last year’s World Economic Forum (2024) underscore that global financial stability faces threats from the rising frequency and sophistication of cyberattacks; tactics have evolved through the use of artificial intelligence, ransomware as a service, and advanced social engineering techniques, enabling attackers to bypass traditional cyber defences. This notion is further supported by various insurance companies assessing cybersecurity risks in businesses (HISCOX Group, 2024), highlighting the crucial role of cybersecurity in the global economy (Kala, 2023). More than 5. 4 billion people and countless groups and organisations actively use the internet. According to estimations and remarks from Kuzior et al. (2022, 2024), the digital transformation market is projected to grow from $ 469. 8 billion in 2020 to $ 1. 01 trillion in the 2025 business year. It may reach up to $ 3. 9 trillion by 2027, with a compound annual growth rate of 16. 1%.

Despite the increasing literature on ransomware’s technical elements, there remains a shortfall in integrated analysis connecting financial impacts to broader disaster risk perspectives (Cvetković, Renner, & Jakovljević, 2024; Jurišić & Marceta, 2024; Mokhele, 2024; Molnár, 2024; Rebouh, Tout, Dinar, Benzid, & Zouak, 2024; Umer, 2024; Vidović, Cvetković, & Beriša, 2024). Understanding the economic stability implications of ransomware and its effects on critical infrastructure and public trust is a significant research gap in the realms of cybersecurity and risk governance. While numerous studies have delved into the technical dissection of ransomware attacks, few have investigated their broader consequences on financial stability, sectoral resilience, and public trust through a holistic, disaster- centric analytical framework (Axon, Erola, Agrafiotis, Uuganbayar, Goldsmith, & Creese, 2023; Benmalek, 2024; Connolly, Wall, Lang, & Oddson, 2020; Goodell & Corbet, 2022; Molina, Torabi, Sarieddine, Bou- Harb, Bouguila, & Assi, 2022; Mott et al., 2024; Pattnaik et al., 2023; Reshmi, 2021; Wollerton, 2023; Zimba & Chishimba, 2019). This research seeks to address this gap. Given the increasing intensity, frequency, and extensive impact of ransomware attacks, these incidents lend themselves to interpretation within a disaster risk framework.

According to the United Nations Office for Disaster Risk Reduction (UNDRR), disaster risk is defined as the potential loss of life, injury, or destroyed or damaged assets that could occur to a system, society, or a community in a specific period, determined probabilistically as a function of hazard, exposure, vulnerability, and capacity (Cvetković, 2023; Cvetković, 2024a, 2024b; Cvetković & Grbić, 2021; Cvetković, Nikolić, & Ivanov, 2023; Cvetković & Renner, 2024; Cvetković & Šišović, 2024; Cvetković, Tanasić, Renner, Rokvić, & Beriša, 2024; Cvetković, 2024a; Cvetković, Dragašević, Protić, Janković, Nikolić, & Milošević, 2022). When interpreted through this lens, ransomware can be seen as a digital hazard that can disrupt systems at scale, amplify vulnerabilities, and test institutional readiness to absorb and recover from shocks. Like natural or technological disasters, ransomware strikes often occur abruptly, cause widespread disruption, and require coordinated responses across multiple sectors (Al-ramlawi, El-Mougher, & Al-Agha, 2020; Aleksandrina, Budiarti, Yu, Pasha, & Shaw, 2019; Carla, 2019; Cvetković, 2019; Cvetković & Janković, 2020; Cvetković & Martinović, 2020; Cvetković Šišović, 2024; Cvetković, Tanasić, Ocal, Kešetović, Nikolić, & Dragašević, 2021; Kumiko & Shaw, 2019; Perić & Cvetković, 2019; Vibhas, Bismark, Ruiyi, Anwaar, & Rajib, 2019; Wedawatta, 2012). This perspective broadens the understanding of ransomware—framing it not solely as a cybersecurity issue, but as a form of digital disaster with profound economic, societal, and institutional implications.

Scalability and anonymity uniquely characterise cyberattacks (Tarter, 2017). As digital transformation speeds up, vulnerabilities proliferate across customer channels (Farahbod et al., 2020), impacting business operations, supply chains, and human capital. This occurs unless security is integrated into the initial designs (George et al., 2024). The increasing complexity of cyberspace exacerbates cyber inequalities, widening the gap between large and small businesses and deepening the divide between developed and emerging economies, creating sectoral disparities (World Economic Forum, 2025). Securing a digital future is crucial in this age of technological advancement and interconnectedness. This commitment to effective cybersecurity is essential for individuals, organisations, and societies (Cobos, 2024; Thakur, 2024).

The central aim of this paper is to examine ransomware as a complex, multidimensional threat that extends beyond traditional cybersecurity narratives. These narratives often focus narrowly on technical vulnerabilities, breach response, and system recovery, without addressing large-scale cyber incidents’ broader systemic, financial, and social ramifications. By situating ransomware within the broader framework of disaster risk, the study evaluates its immediate financial impacts—such as ransom payments, recovery expenditures, and operational disruption—and its longer-term effects, including reputational harm, institutional instability, and socio-economic disparities. This perspective provides a more holistic understanding of ransomware as a digital hazard with systemic implications, capable of weakening economic resilience, compromising critical infrastructure, and diminishing public confidence in both governmental and private institutions. Ultimately, the paper seeks to inform the development of integrated risk governance strategies that reflect the dynamic and interconnected nature of today’s cyber threat landscape. Methodologically, the study draws upon a structured qualitative framework rooted in multiple case studies. The selected cases span diverse geographical and sectoral contexts and are analysed using thematic coding to identify patterns of financial loss, institutional disruption, and socio-economic consequences.

Also, this study adopts a multiple case study framework, examining sixteen globally significant ransomware incidents between 2015 and 2025. The analysis draws on various sources, including institutional documents, academic publications, and financial reports. The paper is organised as follows: Section 2 reviews the theoretical underpinnings and economic dimensions of cyberattacks; Section 3 introduces a classification of ransomware threats; Section 4 details the research methodology; Section 5 and Section 6 analyse the financial, economic, and social impacts; and Section 7 concludes with key takeaways for policy and practical applications.

2. Methods

This research applies a qualitative-descriptive approach, using multiple case studies to explore ransomware’s financial, operational, and societal impacts, especially regarding their disaster-like effects and sector-wide ripple impacts. A purposive sampling method selected sixteen significant ransomware cases from 2015 to 2025. These incidents involved private companies, public entities, critical infrastructure, and even national governments. Selection criteria included data availability, financial impact scale, and variation in attack methods and targeted sectors. Data were drawn from various sources: peer-reviewed studies, institutional reports, cybersecurity datasets, published financial records, and media coverage.

A structured thematic analysis was employed to explore the complex impacts of ransomware attacks. The findings were organised into four main categories: (1) direct financial losses, including ransom payments, data recovery costs, and downtime-related expenses; (2) indirect financial losses, such as rising insurance premiums, legal and compliance costs, and revenue decline from lost customers or contracts; (3) broader economic disruptions, encompassing supply chain breakdowns, service delays, productivity losses, and liquidity challenges; and (4) reputational and societal effects, including diminished public trust, psychological strain on employees and citizens, breaches of data privacy, and weakened institutional credibility. This framework offers a holistic view of ransomware—not just as a cybercrime, but as a disruptive phenomenon with disaster-like ramifications across economic and social domains. To frame these findings, the study adopts a disaster risk perspective, treating ransomware as a complex socio-technical threat that can destabilise economies and weaken infrastructure resilience. Cross-case comparisons uncovered recurring patterns and vulnerabilities, forming the basis for policy discussions and governance recommendations in cyber risk management.

3. Impact of Cyber Attacks on Digital Society and Economy

The COVID-19 pandemic has pushed many business entities from the public and mainly private sectors to a hybrid business environment based on remote work. Initially, it positively impacted both the human capital of companies and the economic and financial results. However, it has also caused an exponential increase in risks due to the use of unsecured devices and applications based on Cloud directories for data transfer (Rahman & Islam, 2022), thereby expanding the exposure of companies to potential attacks, while at the same time, cybercriminal actors are taking advantage of this established dependence of individuals and legal entities on digital technologies (Cook et al., 2023).

Table 1. Regional distribution of the cost impact of cyberattacks. Source: Authors calculation based on data (Sviatun, et al., 2021).

Area / Region	Regional GDP (in trill. $)	Costs of cyberattacks (in bill. $)	Losses caused by cyber attacks (in % of GDP)
North America	20.2	140-175	0.69-0.87
Europe & Central Asia	20.3	160-180	0.79-0.89
East Asia and the Pacific	22.5	120-200	0.53-0.89
South Asia	2.9	7-15	0.24-0.52
Latin America and the Caribbean	5.3	15-30	0.28-0.57
Sub-Saharan Africa	1.5	1-3	0.07-0.20
Middle East and North Africa	3.1	2-5	0.06-0.16
Global	75.8	445-608	0.59-0.80

Table 1. Regional distribution of the cost impact of cyberattacks. Source: Authors calculation based on data (Sviatun, et al., 2021).

Area / Region	Regional GDP (in trill. $)	Costs of cyberattacks (in bill. $)	Losses caused by cyber attacks (in % of GDP)
North America	20.2	140-175	0.69-0.87
Europe & Central Asia	20.3	160-180	0.79-0.89
East Asia and the Pacific	22.5	120-200	0.53-0.89
South Asia	2.9	7-15	0.24-0.52
Latin America and the Caribbean	5.3	15-30	0.28-0.57
Sub-Saharan Africa	1.5	1-3	0.07-0.20
Middle East and North Africa	3.1	2-5	0.06-0.16
Global	75.8	445-608	0.59-0.80

A territorial diversification of the impact of costs and losses from cyber incidents and attacks has been identified, which we see in the results of the authors’ empirical research (Sviatun et al., 2021) that the highest loss rate as a percentage of GDP is determined in Europe and Central Asia, North America and East Asia and the Pacific, and countries from these regions are characterised by high income and income rates, more advanced technological infrastructure, a high degree of urbanisation, education, and business digitalisation (Tariq, 2018).

Globally, the impact of cyber attacks on the world economy is significant (Schwarz et al., 2021) because this sophisticated social phenomenon is rooted in deep and comprehensive geographical and socioeconomic causes (Chen et al., 2023). Cyber ​​threats also impact an organisation’s revenue, reducing it through lost sales, contracts, market share, additional funding, or licenses. In a business context, these typically include marketing and commercial aspects related to sales. However, we also consider that some revenue may not necessarily have such an origin, for example, in public and non-profit organisations (Couce-Vieira et al., 2020).

A cyber incident that disrupts the functioning of vital service segments of critical infrastructure can cause widespread chaos, endanger lives, and cause long-term socioeconomic damage to the economy. While the security of digital components in critical infrastructure serving essential services is essential to maintaining resilience, the combination of digital capabilities and physical components expands potential new risks arising from the combined effect of digital vulnerabilities and the complexity of the physical world (International Chamber of Commerce, 2024).

4. Vector Modalities and Attack Classification

The digital age has led to a wide range of cybersecurity threats that exploit vulnerabilities in technology, processes, and human behavior (Thakur, 2024). Ransomware, malware, and distributed denial of service (DDoS) are examples of evolving cyberattack methods (Cremer et al., 2022).

Of the above vector modalities, ransomware attacks are classified as a distinct form of high-tech crime experiencing the highest growth rate for years. According to research by Putnik et al. (2022), estimates indicate that every 11 seconds, one legal entity becomes a victim of a ransomware attack. Unlike viruses that attach to trusted files or applications and damage or destroy them when launched, worms are a type of malicious software that spreads without user interaction, causing network congestion, computer system slowdowns, or disruptions in basic operating processes (Thakur, 2024), the evolution of ransomware through improvements in the use of encryption and attack vectors, developed attack monetisation modalities, and financial flows through digital payment currencies, which provide discretion of the identity of the contracting party in repayments, defines it as the prevailing malware today (August, et al., 2019). Since this attack modality is based on extortion, it infects a computer system. Further, it prevents access to files, data, and other confidential information or even access to the entire system.

Initially, they implied human interaction, however, looking at the genesis of development, today it is not necessary for the initial infection and its spread through a computer system, where it is characterised by the characteristics of a worm malware, which moves from the infected to unprotected systems in the same computer network without interaction and additional participation of the attacker (August, et al., 2022). Today, ransomware, as the fastest growing and most complex type of cyber attack that does not require technical knowledge and has a broad scope of action, while providing anonymity to the attacker, is a serious risk to global economic flows (Chin, 2024).

The relentless evolution of malicious software poses a significant challenge to cybersecurity, with ransomware emerging as a ubiquitous and destructive threat (Krivokapić et al., 2023). Malware, designed to disrupt electronic devices, constantly evolves, hampering efforts to mitigate its impact. The lack of public disclosure regarding malware attacks, driven by concerns about sensitive information and potential reputational damage, hinders collaborative prevention efforts and makes comprehensive research difficult (Muniandy et al., 2024).

Its attack cycle includes exploitation, infection, delivery, execution, backup manipulation, file encryption, user notification, and cleanup (Muniandy et al., 2024). New techniques have increased the profitability of attacks and the likelihood of success. This includes targeting high-value business entities and ransomware as a service (Gulyas & Kiss, 2023), where ransomware criminals sell customised software packages to the user (The Financial Action Task Force, 2023).

Ransomware as a Service (RaaS) refers to a criminal business model in which ransomware criminals provide ransomware software kits on the Dark Web or engage in elements of a ransomware attack, including malware distribution, initial compromise of the victim’s network, data exfiltration, or ransom negotiations for affiliates in exchange for a fee and/or a percentage. Criminals may also purchase stolen credentials to access and exploit victim systems that enable ransomware distribution and may obtain intelligence on specific industries in specific jurisdictions to inform their targeting and maximise the effectiveness of their attack (The Financial Action Task Force, 2023). The RaaS model has reduced the cost and technical expertise required to conduct ransomware attacks, lowering the barriers to entry and enabling less sophisticated criminals to conduct ransomware attacks.

As one case study in the research in this paper, ransomware is an economically destructive phenomenon that leads to real-world security consequences that often exceed the costs of paying the ransom. In addition to the loss of revenue that an organisation may suffer, other costs may be obvious, some may not. The more obvious costs include paying the ransom (if paid); remediation of the incident, new hardware, software, and incident response services; insurance deductibles; legal fees and litigation; and public relations (Seng et al., 2024).

Financially motivated ransomware attacks utilise vectors such as email, spam, and phishing, making tracking difficult due to using virtual currencies such as Bitcoin to pay ransoms. Several notable ransomware variants, including: BadRabbit, BitPaymer, Cerber, Cryptolocker, Dharma, DoppelPaymer, GandCrab, Locky, Maze, MeduzaLocker, NetWalker, NotPetya, Petya, REvil, Ryuk, SamSam, and WannaCry, have contributed to this evolving threat landscape (Muniandy et al., 2024), some of which are sampled for analysis in this study.

5. Classification of Ransomware Costs and Expenses

A comprehensive approach to the economic aspects of cybersecurity must include a thorough consideration of the direct and indirect costs of cybersecurity measures, as pointed out by researchers (Lis & Mendel, 2019), and the expected damage caused by cyberattacks, especially the type of ransomware attacks studied in the cyberspace of the digital economy. Financial motives for cyber incidents and attacks are the dominant motive in their analysis, accounting for 74% of detected cyber incidents globally and 80% in high-income countries, according to Cobos (2024). In contrast, only 41% of detected incidents in developing countries were primarily financially driven.

By differentiating costs in accounting, a clear division has been formed into direct and indirect costs arising from a cyber attack (Cashell et al., 2004). In this case, direct costs include returning the entire computer system to its original state before the cyber incident, which include additional expenditures on labor and materials but also depend on increased resource expenditures on cybersecurity (software or hardware upgrades).

Direct cost is the monetary equivalent of losses, damage, or other suffering experienced by an individual victim as a result of a cyber attack, which includes loss of monetary value and related inconvenience (Wang et al., 2019). When accounting and financial treatment of investment costs in cybersecurity, it is necessary to consider, according to Kunzler (2023), the investment matrix between the potential costs of a cyber attack, its risks and the costs of security measures. Then there are the costs arising from the interruption of the entity’s operational business, which include lost revenue from the sale of goods, works and services, as well as the loss of productivity, which, under the influence of the domino factor, spreads to customers (Fotis, 2024) but also suppliers (Jimmy, 2024), as well as to the entire organisation (Onuka et al., 2023).

Indirect costs include the type of costs that tend to increase after a cyberattack and immediately after the initial damage to the business entity is repaired, and arise from loss of reputation, damage to the brand, loss of customers, insurance costs and premiums (ThankGod, 2024), litigation and tax costs, economic damage to the parent entity’s subsidiaries, higher investments in cybersecurity for preventive response and opportunity costs of budget resource allocation. They are mainly associated with the economic concept of negative externalities on third parties (Lis & Mendel, 2019). Therefore, indirect costs are characterised by a predominantly intangible nature (Wang et al., 2019), and their consequences are multiple because they affect different aspects of the business, consumers and the broader economy (Cobos et al., 2024).

Table 2. Typology of the most significant direct and indirect losses and costs caused by ransomware attacks.

Direct losses	Indirect losses
Payment of the ransom	Recovery process which includes investigation costs, verification costs for checking the system (diagnostics and remediation) and restoration costs to restory the system to the network (testing)
Data breach	Loss of data as an operating loss caused by business interruption
Other claims for liability for losses suffered by third parties	Loss of customers and business clients
The market value or replacement value of the property or servicies destroyed	Loss of reputation

Table 2. Typology of the most significant direct and indirect losses and costs caused by ransomware attacks.

Direct losses	Indirect losses
Payment of the ransom	Recovery process which includes investigation costs, verification costs for checking the system (diagnostics and remediation) and restoration costs to restory the system to the network (testing)
Data breach	Loss of data as an operating loss caused by business interruption
Other claims for liability for losses suffered by third parties	Loss of customers and business clients
The market value or replacement value of the property or servicies destroyed	Loss of reputation

The critical distinction between the direct and indirect costs of ransomware attacks lies in the exponential growth potential of indirect losses arising from them, compared to the finite limit of direct losses. This dynamic represents a disproportionate burden on society (Cobos, 2024) and has far-reaching consequences for the digital economy, which spills over into the real physical economic sector and business.

6. Analysis and Financial Assessment of the Consequences

The analysis shows that cybersecurity is a multidimensional, heterogeneous and dynamic challenge among countries that may face different optimization problems depending on their threat environment (Cobos, 2024) and that encompasses economic, political, social, digital and technical-technological aspects. The distribution and proliferation of detected cyber incidents by income and geographical regions is complex and influenced by several interrelated factors such as economic prosperity, political stability, cybersecurity capacity and geopolitical tensions (Cobos et al., 2024).

Investing in security technologies represents a capital expenditure. However, as Lee (2021) states, the optimal investment comes at the point where the marginal increase in the price of a cyber investment is equal to the marginal reduction in the financial loss from a cyber attack. Analyzing the subject sample through case studies, it was found that the implementation of robust cybersecurity measures effectively reduced the occurrence of financial data breaches, and that through comprehensive encryption protocols and multi-factor authentication, organizations were able to improve the security of sensitive financial information (Grace, 2023).

Based on available data, the median reported direct loss and damage to a company from all cyber incidents was around $0.4 million, with three-quarters of reported losses below $2.8 million (International Monetary Fund, 2024). However, The distribution is highly skewed, with some incidents imposing losses in the hundreds of millions of US dollars and even accumulating financial damage of several billion dollars. Such extreme losses can lead to liquidity problems for business entities and even threaten their solvency.

Ransomware can cause significant negative consequences for the victim, including non-recovery and recoverable costs. The various types of damages that can occur include financial losses, including ransom payments and the recovery process, operational loss caused by business interruption, and data loss caused by data breaches, which will be discussed in detail below. However, ransomware can also affect third parties, giving rise to liability claims for losses suffered by third parties, loss of customers, and reputational damage (Krivokapić et al., 2023).

Econometric analysis suggests that digitalization and geopolitical tensions significantly increase the risk of cyber incidents (International Monetary Fund, 2024). Based on an extensive survey of available data from previous empirical research, literature, news articles, and official databases of international institutions reporting on cyber attacks, the analysis identified the factors of financial damage, expenditures, and costs caused by ransomware attacks in a sample of 16 case studies over the period 2015 to 2025.

Table 3 outlines the direct and indirect financial damages linked to sixteen major ransomware incidents reported between 2015 and 2025. Direct losses range from moderate figures—such as $1.87 million in the Technion University case—to extreme levels, including the $10 billion damages reported in the MOVEit and NotPetya attacks. While direct costs are often substantial, indirect losses carry even more profound implications. These include legal fees, regulatory fines, system recovery expenses, and long-term disruptions to business continuity. Particularly severe financial impacts were observed in critical infrastructure and healthcare systems cases. Overall, the findings underscore the disproportionate growth of indirect costs relative to direct ones, highlighting ransomware’s potential to trigger systemic economic instability.

Table 4 broadens the focus by categorising each incident’s economic and social outcomes. A consistent pattern emerges: essential services—healthcare, transportation, education, and public administration—are frequently disrupted. These service interruptions are often accompanied by public distrust, reputational setbacks, and heightened psychological stress. In critical cases like WannaCry and Colonial Pipeline, the consequences escalated into public safety concerns, prompting governmental intervention and emergency actions. This division between economic and social impacts further illustrates the multifaceted nature of ransomware, resembling disaster events in their capacity to disrupt digital infrastructures and societal stability.

Table 5 details the attack vectors and techniques used across the analyzed cases, revealing a clear progression in complexity. Early methods, such as phishing emails and malware attachments (e.g., CryptoLocker, Locky), have evolved into advanced, multi-vector attacks employing zero-day exploits, supply chain breaches, and ransomware-as-a-service models. Tactics now often include automation, stolen credentials, and lateral movement within networks, reflecting a trend toward scalable, professionalized cybercrime. Encrypted communications and anonymous payment systems—most notably cryptocurrency wallets—continue to hinder attribution and response. This evolution supports the interpretation of ransomware as more than just a criminal act, positioning it as a form of digital disaster within contemporary risk governance frameworks.

7. Discussion

The evidence presented in this paper reinforces the classification of ransomware as a high-impact, cross-border threat that mirrors large-scale disruptive events typically categorized as disasters. Its spread through digital infrastructure, exploitation of systemic weaknesses, and far-reaching secondary effects—particularly on public trust, service continuity, and social stability—position ransomware within the broader category of complex socio-technical risks requiring coordinated, multisectoral responses (Andersen, 2025; Axon et al., 2023; Connolly & Wall, 2019; Moussaileb, Cuppens-Boulahia, Lanet, & Bouder, 2021; Nagar, 2024; Robles-Carrillo & García-Teodoro, 2022; Singh & Sittig, 2016; Sudheer, 2024; Wilner et al., 2019; Yuste & Pastrana, 2021).

Notably, the concentration of indirect and intangible costs in essential sectors like healthcare, utilities, and government services reveals a significant policy gap: the absence of adaptive cyber resilience frameworks tailored to critical infrastructure (Cvetković, 2013; Cvetković & Kezunović, 2021; Cvetković, 2024b; Hromada & Lukas, 2012; Koliou, van de Lindt, Ellingwood, Dillard, Cutler, & McAllister, 2018; Mijalković & Cvetković, 2013; Vidović, Cvetković, & Beriša, 2024). This issue is especially pressing in transition and lower-capacity economies, where digital advancement often outpaces the development of effective risk management systems. The proliferation of ransomware-as-a-service (RaaS) further enlarges the threat landscape, increasing the volume of attacks and diversifying their targets—strengthening the case for framing ransomware as an evolving disaster phenomenon.

In the last ten years, an exponential growth of ransomware strains and changes in the malware market have been identified, which implicitly affect the challenges, risks, and threats to the barrier that prevents large-scale cyber attacks (August et al., 2019). A comprehensive analysis of empirical evidence and data has produced a systematic overview in Table 3Table 4 and Table 5 of this paper. The period from 2015 to 2019 was identified in the analysis as an early period of gradual but exponential growth in cybercrime, including ransomware attacks, which accumulated significant losses and financial damage, primarily direct and indirect costs determined to be unpredictable per attack. The most significant case studies were found to be the "Locky", "NotPetya" malware and "WannaCry" ransomware attacks. Then, from the end of 2019, the crisis caused by the coronavirus pandemic occurred, which in 2020 was a catalyst for the development and vector distribution of ransomware attacks through a rapid degree of digitalisation and the establishment of a hybrid business model, primarily on critical infrastructure as a vital interest of every state, through the health sector, the financial sector and the energy sector.

Collectively, the findings from Table 3, Table 4 and Table 5 strengthen the framing of ransomware as a form of digital disaster. These incidents share key characteristics with traditional disasters—unpredictability, large-scale disruption, cascading impacts, and significant financial and human costs. The comparative analysis highlights that attacks targeting healthcare and government sectors often result in the highest indirect losses and the most profound societal consequences. This underscores the need for cyber resilience efforts to prioritize sectors that are both highly dependent upon and vulnerable to digital infrastructure. Additionally, the evolution of attack methods indicates the necessity for ongoing adaptation in technical defenses and organizational risk management strategies.

By establishing continuous monitoring of threats arising from ransomware attacks, it was found that in 2021 there were record ransom payments for ransomware attacks ($ 1.1 billion), which indicated the growth of cybercrime and the characteristic of greater profitability of cyberspace attacks on the digital economy. In 2022, the number of reported cyberattacks continued to grow, and the financial damages were significant - indicating increased incidents and a growing, primarily negative impact on the economy.​ Total global losses from cyberattacks in 2023 exceeded $12.5 billion, an increase of 22% compared to the previous year. Ransomware attacks were among the most significant. ​In the first half of 2024, payments from victims of ransomware attacks reached $460 million, an increase of 2% compared to the same period in 2023. Projections indicate a continued growth trend in cyberspace attacks, of which ransomware attacks are the type with the most significant impact on the digital economy, with devastating socio-economic consequences for the economy and population, and above all for critical infrastructure.

From a governance standpoint, these findings underscore the urgent need for integrated risk management strategies that extend beyond technical enhancements. Governments should incorporate cyber-disaster scenarios into national emergency planning, mandate cyber incident reporting, and incentivize investments in cyber hygiene—particularly within the public sector. The response must go beyond infrastructure security for private-sector organizations, especially in finance, health, and energy. It should also strengthen organizational resilience through staff training, redundancy protocols, robust data recovery planning, and insurance coverage reflecting contemporary digital risks. Public-private partnerships and shared platforms for threat intelligence are key to managing sectoral interdependencies.

At the international level, the extraterritorial nature of ransomware calls for deeper collaboration on attribution, enforcement, cryptocurrency oversight, and intelligence exchange. Finally, future research should prioritize the development of quantitative models that capture both direct and cascading costs, as well as scenario-based simulations to assess sector-specific preparedness. Longitudinal studies tracking recovery trajectories post-attack could further enrich the understanding of institutional resilience, complementing the cross-sectional insights provided in this study.

8. Conclusions

This paper has shown that ransomware should no longer be viewed solely as a cybersecurity challenge, but as a complex and evolving disaster risk with far-reaching consequences for economic stability, institutional resilience, and public trust. Drawing on sixteen high-impact case studies, the research offers a typology of financial losses and systemic disruptions, emphasizing the disproportionate effects on critical infrastructure and the compounding nature of indirect costs. By framing ransomware as a form of digital disaster, the study contributes to a more integrated approach to cyber risk within the broader context of disaster risk governance and resilience planning.

The findings point to several practical implications, calling for coordinated but context-specific action from key stakeholders: a) governments should incorporate ransomware preparedness into national risk strategies, encourage transparent incident reporting, and provide fiscal incentives for cybersecurity investments; b) private-sector entities need to implement zero-trust architectures, develop insurance solutions tailored to cyber threats, and enhance organisational resilience that extends beyond technical safeguards; c) at the international level, institutions must advance cross-border collaboration—particularly in regulating virtual assets, supporting joint law enforcement efforts, and setting global standards for cyber disaster response.

The financial impact of cybercrime has reached staggering proportions, with projections indicating an alarming upward trend. An unfortunate aspect of today’s online society affects businesses of all sizes. The global scale of financial flows associated with ransomware attacks has grown dramatically in recent years. New techniques have increased the profitability of attacks and the likelihood of success. These include targeting large, high-value entities and ransomware-as-a-service, where ransomware criminals sell customized software kits to affiliates. The consequences of a ransomware attack can be dire and pose national security threats, including damage and disruption to critical infrastructure and services. A ransomware attack is a form of extortion and FATF standards require it to be criminalized as a predicate offense for money laundering (The Financial Action Task Force, 2023). Ransomware criminals exploit the international nature of virtual assets to facilitate large, near-instantaneous cross-border transactions, sometimes without the involvement of traditional financial institutions that have programs in place to prevent money laundering and terrorist financing.

Ransomware attacks are on the rise globally, and any business or organization can be a target of these attacks, which requires additional attention and preparation in terms of business cyber security and the complete protection of the digital economy. As Krivokapić et al. (2023) point out, it is crucial that all relevant institutions, including financial institutions, are informed about the ransomware attack and the ransom payment. This is important because it provides sufficient evidence for possible legal proceedings or cancellation of ransom payments. Also, business entities should invest in insurance policies that include cybersecurity, as general commercial policies do not provide sufficient protection against cyber attacks. These insurances help cover the costs arising from attacks such as ransomware (Cobos et al., 2024). Since states cannot always effectively protect themselves from cyber attacks, it is recommended that they encourage investment in cybersecurity. This can be supported by introducing tax breaks and double deductions for costs related to cybersecurity.

The first recommendation is to continue investing in workforce education and training, so that individuals can identify threats and respond effectively (World Economic Forum, 2025). Then, it is necessary to adopt a zero-trust approach, which minimizes the risk of attacks by treating all requests as potentially malicious. It is also important to improve incident response plans to respond quickly to cyberattacks and reduce their impact. Advanced technologies, such as artificial intelligence and automation, should be used to improve threat detection and predictive analytics, but with caution against attacks launched by artificial intelligence (Thakur, 2024). Collaboration and information sharing between members of the cybersecurity community is also key to strengthening defenses. Data protection and privacy should be a priority, along with regulatory compliance and transparent communication. Finally, it is important to regularly assess and update security to identify new vulnerabilities and adapt defenses to new threats, because cybersecurity is an ongoing process, requiring a proactive approach, collaboration, and integration of modern technologies to successfully confront evolving threats.

This study has limitations. The analysis relies on publicly available data, which may exclude undisclosed or underreported incidents. Future research should focus on longitudinal data, sector-specific vulnerabilities, and modeling recovery trajectories after major ransomware events. In closing, confronting the ransomware threat demands more than just technological fixes. It requires a fundamental shift in how digital risk is conceptualised, governed, and financed. Without integrated, adaptive, and inclusive strategies, ransomware may become one of this century’s defining disaster threats.