The INTEL
Most cyber incidents are data exposure. The costliest ones mostly aren’t. Across all incidents, about 91% are mainly data exposure; among the costliest 5% of events over five years, that falls to 33%, and operational disruption rises from 8% to 43%, according to the Cyentia Institute.
Cyentia’s IRIS Xtreme 2026 classifies each event by its primary outcome: data exposure, disruption, or fraud. The shift at the extreme end is large:
- Exposure: 91% of all incidents, 33% of extreme events
- Disruption: 8% of all incidents, 43% of extreme events
- Fraud: under 1% of all incidents, 24% of extreme events, much of it cryptocurrency theft
Set the crypto thefts aside and the pattern is clearer still. For the remaining extreme events, business interruption and lost sales are the largest share of losses (20%), ahead of response and notification costs (18%), which are reported more often but cost less.
The impact also travels. Nearly half of extreme events (46%) spread into the victim’s supply chain, and those events account for 55% of losses.
Why It Matters
Most risk registers are built from what happens most often, and what happens most often is data exposure. That puts the planning effort on breach response and notification, while the losses that reach the top of the scale come from operations stopping: production halted, orders unfilled, systems down for weeks.
This is hindsight evidence. Cyentia’s data runs to early 2025, because the cost of a cyber event takes many months to become known. But the pattern held after the data closed: the 2026 Verizon DBIR describes the Jaguar Land Rover ransomware attack, which halted production for five weeks and rippled across about 5,000 downstream organizations.
The useful part is that disruption is something an organization can plan and rehearse for. How long operations can run without key systems, and how fast they come back, is largely within its control.
What To Do — One Key Action
Check whether your risk register includes a multi-week outage, both of your own operations and of a supplier you depend on. If it doesn’t, add those scenarios, estimate the cost of the downtime, and check that your insurance covers business interruption at a matching level, not just response costs.
MITRE ATT&CK
- T1486 Data Encrypted for Impact — ransomware, the leading pattern behind disruption losses among extreme events
- T1489 Service Stop — the operational outcome this INTEL is about
Learn More
- IRIS Xtreme 2026 (Cyentia Institute) — Primary source; primary outcomes (Figure 9, p15), loss types (Table 2, p18), secondary impacts (Figure 13, p19)
- FIR Risk Tuesday E96 — The Costliest 5%: What Confirmed Losses Teach Us About Planning — Full analysis
- FIR Risk Tuesday E90 — Refinement, Not Revolution — The 2026 Verizon DBIR, including the Jaguar Land Rover case
Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.