  As cyber-attacks continue to increase in frequency and sophistication,
organisations must be better prepared to face the reality of an incident. Any
organisational plan that intends to be successful at managing security risks
must clearly understand the harm (i.e., negative impact) and the various
parties affected in the aftermath of an attack. To this end, this article
conducts a novel exploration into the multitude of real-world harms that can
arise from cyber-attacks, with a particular focus on ransomware incidents given
their current prominence. This exploration also leads to the proposal of a new,
robust methodology for modelling harms from such incidents. We draw on
publicly-available case data on high-profile ransomware incidents to examine
the types of harm that emerge at various stages after a ransomware attack and
how harms (e.g., an offline enterprise server) may trigger other negative,
potentially more substantial impacts for stakeholders (e.g., the inability for
a customer to access their social welfare benefits or bank account). Prominent
findings from our analysis include the identification of a notable set of
social/human harms beyond the business itself (and beyond the financial payment
of a ransom) and a complex web of harms that emerge after attacks regardless of
the industry sector. We also observed that deciphering the full extent and
sequence of harms can be a challenging undertaking because of the lack of
complete data available. This paper consequently argues for more transparency
on ransomware harms, as it would lead to a better understanding of the
realities of these incidents to the benefit of organisations and society more
generally.
