How much does it cost to respond to a ransomware attack or data breach?

What you're really buying: responding to the incident vs. having response ready

Before any numbers, you have to separate two questions that are often confused. The first is: how much does it cost to RESPOND when the incident is already happening — the company down, the files encrypted, the extortion notice on the screen. The second is: how much does it cost to HAVE incident response contracted and ready before anything goes wrong. They are different products, with opposite pricing logics, and whoever buys without understanding that difference almost always pays the worse price.

Responding in an emergency is like calling a tow truck on the highway at 3 a.m. with your car on fire: you're not negotiating, you're accepting. The vendor knows your company is down, that every hour is expensive and that you don't have time to gather three proposals. That is the scenario of the greatest possible power asymmetry in a commercial relationship — and it is exactly the one many companies enter, because they never contracted incident response before needing it. The result is a panic hourly rate, an improvised contract, and work that starts hours or days late while paper is signed and budget is approved.

Having response ready is the opposite. It's contracting, in peacetime, an Incident Response (IR) team that stays available 24x7 under a retainer — a kind of on-call plan. You pay a monthly or annual fee to guarantee three things: a start SLA (the team begins acting in hours, not days), an already-negotiated forensic hourly rate well below the emergency one, and a team that already knows your environment at least somewhat. When the incident comes, there's no quoting, no vendor panic: there's a phone you call and people who start working.

Decripte structures this into two complementary plans. The Incident Response plan (IR 24x7) is the on-call service that guarantees a fast start and a contracted forensic rate — it is the primary product of this decision. The SOC 24x7 plan acts earlier: it's the continuous detection that spots the attack early and reduces the size of the damage, shortening precisely the 258 average days IBM measures between the start of the breach and containment. The two together attack the variable that weighs most on the bill — time. If you don't yet know where you're exposed, the free assessment at the Intelligence Center maps your current risk before any purchase.

The real cost of an incident: why the ransom is the smallest part of the bill

The question 'how much does an attack cost' rarely has the ransom amount as its answer. The ransom is the most visible part and, frequently, the smallest. The cost of an incident is a sum of components few people see until they've lived through one. The biggest is downtime. When the ERP, the e-commerce, the invoicing system or the entire operation goes offline, every hour has a price — in unearned revenue, in idle staff, in customers who walk away. IBM estimates that unplanned downtime resulting from ransomware can reach US$ 125 thousand per hour at larger organizations. Even at a mid-sized Brazilian company, days of stalled operations easily mean tens to hundreds of thousands of reais.

The second component is forensics and containment. Responding to a serious ransomware attack requires investigating how the attacker got in (the initial vector), what they accessed and moved (lateral movement), whether data was exfiltrated before encryption (so-called double extortion), and then eradicating their presence and restoring safely. This technical work is measured in specialist hours, and the market benchmark is clear: IBM points out that ransomware typically requires, at minimum, on the order of 150 hours of response to be fully remediated. The hourly rate for those hours is what varies most between the emergency and contracted scenarios.

The third component is legal and regulatory. If personal data leaked, the LGPD comes into play. There's the cost of specialized legal counsel, of notifying the ANPD within the deadline of Resolution CD/ANPD No. 15/2024, of communicating with affected data subjects and, potentially, of an administrative sanction. The fourth and most lasting is lost business: customers who cancel, contracts that don't renew, a reputation that takes years to rebuild. IBM measures this 'lost business' as one of the largest slices of the total breach cost — and it's the one that doesn't show up on the invoice, but shows up on next year's balance sheet.

Adding it all up, you reach IBM's numbers: an average data breach cost in Brazil of R$ 6,75 million in 2024 and R$ 7,19 million in 2025, with regulated sectors even more exposed (health at R$ 11,43M, finance at R$ 8,92M). That is the size of the problem incident response exists to contain. And that's why the conversation about the price of IR should never start with the cost of the service — it should start with the cost of not having the service.

Real price ranges in Brazil: emergency, retainer and forensics per hour

Being honest about numbers: there's no single price for incident response, and any vendor that fixes a set figure without knowing your environment is either guessing or hiding something. The price is a function of the scope — how many servers and endpoints, whether there was encryption or only a leak, the volume and sensitivity of the data, urgency, and whether or not you have intact backups. What can be done honestly is to give market ranges and teach you how to position yourself within them.

In the EMERGENCY model (you call with no contract, incident underway), the work is billed per hour or per hour package, at panic rates. The international benchmark is US$ 800 to US$ 1,500 per senior IR specialist hour. In the Brazilian market, a small, well-scoped emergency engagement rarely comes in under R$ 30–80 thousand; a mid-sized ransomware event with forensics, restoration and notification typically falls in the R$ 150 thousand to R$ 500 thousand or more range, depending on days of downtime and forensic hours. Add to that the invisible cost: the time until the team starts, because without a contract you spend critical hours quoting, approving budget and signing paper while the company is down.

In the RETAINER model (you contract in advance, in peacetime), there are two components. A readiness monthly/annual fee — which in the international market runs from US$ 10 thousand to US$ 100 thousand per year depending on size, and which in Brazil, for small and mid-sized companies, usually falls in the R$ 2 thousand to R$ 15 thousand per month range — and an already-contracted, discounted forensic hourly rate for when the incident happens (the international benchmark for a contracted hour is US$ 175–400, versus the US$ 800–1,500 emergency rate). Many retainers also convert unused hours into assessment, simulations and hardening, so the money isn't wasted if nothing happens.

The arithmetic favors the retainer consistently. An example from the market itself: 500 response hours at the emergency rate of US$ 1,000/h cost US$ 500 thousand; the same 500 hours at the contracted rate of US$ 300/h cost US$ 150 thousand, plus the US$ 30 thousand annual fee — a total of US$ 180 thousand, against US$ 500 thousand. A savings of nearly three times, before even counting the gain from starting hours earlier. To size your own case, start with the Intelligence Center: the free assessment estimates the size of your environment and your risk, which is what defines the range you fall into.

Table: the cost of an unprepared incident vs. with an IR plan

The clearest way to see the value of contracting incident response in advance is to place the same incident side by side — a mid-sized ransomware event with signs of a leak — in the two scenarios: the company that had nothing contracted and the company that had an active IR retainer. The components are the same; what changes is the price of each one and, above all, the speed. The table below (in this page's comparison block) details it item by item. Here it's worth highlighting the logic behind each line.

The start of the response is the most expensive difference of all. Unprepared, from the moment you notice the incident to the moment the team starts acting, 1 to 3 days usually pass — time to find a vendor, close an emergency contract and approve a budget. With a retainer, the SLA guarantees a start in hours. Every extra hour of downtime is lost revenue and spreading damage, so compressing that interval is what most reduces the total cost. It's no accident that IBM shows breaches contained in under 200 days cost about US$ 1 million less than those that dragged on beyond that.

The forensic rate is the second difference. The same specialist hours cost 2 to 4 times more in emergency mode. And the third is the regulatory part: unprepared, notification to the ANPD and to data subjects is done in a rush, with the risk of missing the deadline and worsening the penalty calculation; with a plan, the legal-regulatory flow is already mapped. The combined effect is what IBM quantifies: companies with an IR team and a tested plan had an average breach cost 58% lower (US$ 3.26 million against US$ 5.29 million), and the tested plan, on its own, cuts an average of US$ 2.66 million from the bill — the single biggest reducer in the report.

In short: the 'unprepared' scenario is not only more expensive on every line — it's more expensive precisely on the lines that weigh most (downtime and lost business), and it's slower exactly where speed is worth the most. The retainer doesn't eliminate the incident; it turns a catastrophic, unpredictable event into a controlled, manageable cost.

LGPD, ANPD and the regulatory cost of a breach

When the incident involves personal data — and most modern ransomware steals data before encrypting it, precisely to extort twice — the response stops being purely technical and becomes legal and regulatory as well. Ignoring this layer is one of the most expensive ways to get it wrong, because the regulatory cost adds to the technical one and can, on its own, exceed it.

The LGPD (Law No. 13.709/2018) provides, in art. 48, the duty to notify the ANPD and the data subjects of a security incident that may cause relevant risk or harm. Resolution CD/ANPD No. 15/2024 detailed the procedure and deadline for that notification. The practical point: the notification clock starts early, and whoever discovers the breach and doesn't report it ends up, in the language of penalty calculation, having the omission counted against them. Resolution CD/ANPD No. 4/2023 regulates how the ANPD calculates the sanction, based on the criteria in art. 52, §1 of the LGPD — severity, good faith, advantage obtained, economic condition, recidivism, degree of harm, cooperation and, crucially, the demonstrated adoption of internal mitigation mechanisms.

That last criterion is where incident response becomes a concrete mitigating factor. Having a response plan, acting fast, containing, notifying within the deadline and cooperating with the authority are exactly the behaviors the penalty calculation rewards with a smaller sanction. The reverse — discover, hide, delay — aggravates it. LGPD sanctions range from a warning to a fine of up to 2% of the company's revenue, capped at R$ 50 million per violation (art. 52). And it's no longer theoretical: the ANPD has moved past the guidance phase and started applying sanctions, with thematic enforcement in sectors such as health and biometrics.

That's why a good incident response service in Brazil doesn't deliver only technical forensics — it delivers the package: containment, preserved forensic evidence (which may be needed in court or before the ANPD), support for regulatory notification within the deadline and communication to data subjects. Buying IR looking only at the technical part and discovering, mid-incident, that no one handles the ANPD part is discovering too late that half the cost was left uncovered. When contracting, explicitly confirm that the scope covers the LGPD/ANPD flow.

Retainer vs. emergency: why on-demand costs much more

The question that clinches the decision is direct: if I can just call someone when I need to, why pay a monthly retainer for something I might never use? The answer has three layers, and all point to the same place.

First layer, the price of the hour. In the emergency you buy at the worst possible moment, with no bargaining power, at rates 2 to 4 times the contracted one. It's the panic premium, and it's structural — it's not the vendor being greedy, it's the market pricing urgency, immediate availability and the risk of mobilizing a senior team outside any planning. Second layer, the time until you start. Without a contract, before the first forensic hour runs, you spend precious hours or days quoting vendors, validating their standing, closing a contract and releasing budget — all with the company down and the damage spreading. The retainer buys an SLA: someone answers and starts within hours. Because the incident bill is dominated by downtime, compressing that interval is the biggest generator of savings.

Third layer, and the most underestimated, prior preparation. A team that enters your environment cold on incident day first has to understand your network, your systems and your backups — time you pay at the panic rate. A team on retainer has already done an initial assessment, already knows your topology, already knows where the critical data is and whether your backups are any good. It starts by containing, not by studying. And in the months when nothing happens, the retainer hours aren't lost: they turn into simulations, plan tests (the very tested plan IBM cites as the biggest cost reducer), backup reviews and hardening — that is, they turn into prevention that reduces the likelihood and size of the next incident.

The honest conclusion is this: the retainer isn't insurance against an unlikely event; it's management of an event that, statistically, will happen to most companies at some point. It trades a catastrophic, unpredictable and poorly negotiated cost for a modest, predictable monthly cost, with a guaranteed SLA. For anyone running systems the business depends on — e-commerce, fintech, SaaS, any company with customer data — the question isn't 'is it worth it?', it's 'can I absorb days of downtime and a six-figure bill on the company's worst day, with nothing contracted?'. If the answer is no, the retainer has already paid for itself. Start with the free Intelligence Center assessment to see your current risk, consider the SOC 24x7 plan to detect early and reduce impact, and set up the on-call service with the Incident Response 24x7 plan.

Same mid-sized ransomware: unprepared (emergency) vs. with an IR retainer

Key terms

Incident Response (IR)

The set of technical, legal and organizational actions to detect, contain, eradicate and recover the operation after a security incident (ransomware, intrusion, breach). It includes forensics, safe restoration and support for regulatory notification.

IR retainer (contracted on-call)

A contract signed in peacetime that guarantees 24x7 availability of a response team, with a start SLA (hours) and an already-negotiated, discounted forensic hourly rate. Paid as a readiness monthly or annual fee; unused hours usually turn into simulations and hardening.

Double-extortion ransomware

An attack in which the criminal first exfiltrates (steals) the data and only then encrypts it, extorting the victim twice: to return access and to keep the leaked data unpublished. That's why nearly every modern ransomware is also a breach subject to the LGPD.

Time to identify and contain (MTTI/MTTC)

How long, on average, it takes between the start of a breach and its identification and containment. IBM measured 258 days in 2024. The longer this time, the greater the cost — which is why detection (SOC) and a fast start (retainer) are the main loss reducers.

ANPD penalty calculation (dosimetry)

The method by which the ANPD calculates the administrative sanction for an LGPD violation, governed by Resolution CD/ANPD No. 4/2023 and the criteria of art. 52, §1. It considers severity, cooperation, recidivism and the demonstrated adoption of mitigation measures — which makes having incident response a concrete mitigating factor.

Downtime (unplanned outage)

The period during which critical systems are unavailable because of the incident. It's the biggest component of an attack's cost: IBM estimates it can reach US$ 125 thousand per hour at larger organizations. Reducing downtime is the central goal of fast response.

SOC 24x7 (Security Operations Center)

A security operations center that continuously monitors the environment to detect attacks early. It acts before incident response, shortening the time to detection and, with that, reducing the size and cost of the damage.

How to decide and hire well

1. Size your risk before quoting price: run the free assessment at the Intelligence Center to map your environment (how many systems, which sensitive data, current exposure). This is what determines the price range you fall into — without it, any quote is a guess.
2. Decide the right model for your size: if your operation depends on systems that can't go down (e-commerce, fintech, SaaS, any customer base), contract an IR retainer before you need it. Emergency response with no contract only makes sense as a last resort, never as a strategy.
3. Confirm the start SLA in writing: ask how many hours it takes for the team to start acting after being called, during business hours and after. That number is what most reduces your real cost. Be wary of anyone who won't commit to an SLA.
4. Check that the scope covers the LGPD/ANPD flow: the service should include forensic evidence preservation, support for notifying the ANPD within the deadline of Resolution CD/ANPD No. 15/2024 and communication to data subjects — not just the technical part.
5. Ask about prior preparation: a good retainer runs an initial assessment, knows your topology and validates your backups before the incident. Confirm that unused hours turn into simulations, plan tests and hardening — not wasted money.
6. Compare the contracted vs. emergency hourly rate: explicitly ask for the discounted forensic rate in the retainer and compare it with the same vendor's emergency rate. The difference (typically 2 to 4 times) is your real gain.
7. Check the team's qualifications and standing: proven experience with ransomware, use of recognized frameworks (MITRE ATT&CK to map the attacker), the ability to produce a forensic report that stands up before the ANPD and in court. On the worst day, you want people who've done this before.
8. Combine detection and response: contract SOC 24x7 to spot the attack early and the Incident Response 24x7 plan to act fast. The two together attack the variable that dominates the cost — time.
9. Reread the contract as a contract, not a brochure: limits on included hours, what counts as 'out of scope', the cost of extra hours, confidentiality and who owns the evidence. Negotiate that in peacetime, never during the incident.

Frequently asked questions

References

• ›IBM Cost of a Data Breach 2024 — average cost Brazil R$ 6,75M; time to identify/contain of 258 days — IBM Security / ABES — relatorio-da-ibm-custo-medio-de-uma-violacao-de-dados-no-brasil
• ›IBM Cost of a Data Breach 2025 — average cost Brazil R$ 7,19M; tested IR plan as the biggest cost reducer — IBM — ibm.com/reports/data-breach
• ›Resolution CD/ANPD No. 15/2024 — notification of security incidents to the ANPD and to data subjects — ANPD — gov.br/anpd
• ›Resolution CD/ANPD No. 4/2023 and art. 52 of the LGPD — penalty calculation and administrative sanctions (fine up to 2%, capped at R$ 50M) — ANPD — gov.br/anpd/pt-br/assuntos/noticias/anpd-publica-regulamento-de-dosimetria
• ›IR market ranges — emergency hour US$ 800–1,500 vs. contracted US$ 175–400; retainer US$ 10k–100k/year — IncidentCost.com / Cynet — incidentcost.com/response-cost
• ›MITRE ATT&CK — framework of adversary tactics and techniques used in forensics and incident response — MITRE — attack.mitre.org