What the maths does
- Lost productivity is staff, times hourly cost, times 7.6 hours a day, times days, times the share of work that cannot get done.
- Revenue lost for good is your daily figure times days.
- Recovery and response is $4,500, plus $190 per staff member, plus $900 per day. It stands in for investigation, rebuilding and the overtime nobody budgets for.
- Breach assessment, advice and any notification, only when ticked, is $12,000 plus $240 per staff member.
- Cash delayed is your delayed figure times days. It is shown on its own line and is not added to the total.
Where the range comes from
The four counted costs are added together. The low end of the range is that total times 0.62, and the high end is that total times 1.85. The low end assumes things go about as well as they reasonably can: clean backups, a quick diagnosis, no regulator involvement. The high end assumes the ordinary complications, because they are ordinary. Both multipliers are judgement, not statistics, and neither end is a worst case. A genuine worst case involves losing clients, and no calculator should pretend to price that.
Not counting the same loss twice
Lost productivity is the cost of paid staff time that produced nothing. Revenue lost is income from work that could not be delivered and will not be recovered. They measure different things, but it is easy to enter the same loss under both. Enter only revenue that would genuinely not come back, and do not include the value of the same hours you have already counted as lost productivity. If a late invoice will still be paid, it belongs in revenue delayed, which is not counted as a loss.
The breach line
Personal information being involved is not the same as a notifiable breach. Under the Notifiable Data Breaches scheme, a breach is notifiable where there is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm, and remedial action has not prevented that likely harm. Organisations covered by the Privacy Act also have to assess a suspected breach promptly. The breach line covers that assessment, legal advice, and notification if it turns out to be required.
How much to trust the numbers
The dollar constants above are illustrative assumptions for a small Australian business. They have not been validated against a specific dataset, and your own costs will differ. The breach line was informed by the IBM Cost of a Data Breach report and the OAIC's notifiable data breach guidance, scaled down to small business by judgement rather than by formula. This is an estimate for a conversation, not a quote.
What it deliberately leaves out
Reputational damage, lost clients, staff turnover afterwards, higher insurance premiums at renewal, and the cost of the directors' attention for a month. These are real and often the biggest numbers, and they cannot be estimated from a few sliders.
