Human & Financial Costs of a Breach

Why ransomware is more than just a financial threat

The final episode of this series covering Sophos’ 2025 report ‘The State of Ransomware’. Brian Sibley, VCTO at Espria and Jon Hope, Cyber Security Evangelist at Sophos explore the often-overlooked human toll of ransomware attacks. Beyond the monetary damage, they reveal how breaches impact mental health, workplace dynamics and even leadership stability, making this a must-listen for anyone involved in cybersecurity or business continuity. 

The compelling final episode of the Espria podcast series on The State of Ransomware 2025 report. Brian Sibley is joined once again by Jon Hope from Sophos to delve into a critical and often under-discussed aspect of ransomware: its human impact. 

While previous episodes focused on attack profiles and industry statistics, this conversation shifts the lens to the psychological and organisational consequences of ransomware incidents. The discussion begins by acknowledging that ransomware is not just an IT or financial issue, it’s a deeply human one. IT professionals, often under immense pressure, face guilt, anxiety and even burnout following an attack. In fact, 31% of cases involve long-term stress-related absences and in 25% of incidents, senior IT leaders lose their jobs, regardless of fault. 

The episode highlights how cybersecurity is still perceived as an IT-only problem in many organisations, which contributes to the lack of support and recognition for IT teams. However, there’s a silver lining; 30% of IT managers report increased recognition post-incident, suggesting a shift in how businesses value their cybersecurity teams. 

Beyond the workplace, the ripple effects extend to families and communities, especially when victim organisations operate in critical sectors like healthcare or social care. A ransomware attack on a hospital, for example, can disrupt essential services and even endanger lives. 

The conversation also explores the evolving tactics of cybercriminals. Ransom demands are now more strategically calculated based on a victim’s ability to pay, with some organisations managing to negotiate payments down to 85% of the original demand. However, negotiation is risky, 18% of organisations end up paying more due to missteps or perceived desperation. 

Jon Hope explains how ransomware has become industrialised, with cybercriminals operating like legitimate businesses, complete with ROI models and affiliate networks. This scalability means that even small organisations are no longer safe from attack. The myth of being “too small to be a target” is firmly debunked. 

The episode concludes with a call for collaboration, both within organisations and across the cybersecurity industry. Sophos’ Managed Detection and Response (MDR) service is presented as a way to share the burden, learn from global incidents and strengthen defences collectively. The idea is to build a “cybersecurity club” where knowledge is pooled and everyone benefits, mirroring the way cybercriminals themselves share tools and tactics. 

Key Takeaways: 

• Ransomware has significant psychological and organisational consequences. 

• IT teams often face guilt, stress and job loss after incidents. 

• Cybercriminals tailor ransom demands based on victims’ ability to pay. 

• Negotiation can reduce costs but also backfire. 

• No organisation is too small to be targeted. 

• Collaboration and shared intelligence are essential to combat ransomware. 

• Sophos MDR offers a proactive, community-driven approach to cybersecurity. 

This episode is essential listening for business leaders, IT professionals and anyone involved in risk management. It’s a powerful reminder that cybersecurity is not just about systems, it’s about people.