It's Monday morning. Your staff switch on their computers and see the same message on every screen: "Your files have been encrypted. Pay €50,000 in Bitcoin within 48 hours or the data is gone." It's not a film. It's the scenario hundreds of Romanian companies have gone through in the last 3 years — accounting firms with year-end accounts locked, clinics without access to patient records, notary offices paralysed.
The question everyone asks after the incident is the same: what did it actually cost? The answer is almost always much higher than the amount in the ransom note.
Direct costs: what you pay straight away
The ransom varies enormously depending on the attacking group and how profitable your company appears. For Romanian SMEs, demands range from €5,000 to €200,000. The European average for companies with fewer than 50 employees is around €50,000, according to Sophos' State of Ransomware 2024 report. And paying doesn't guarantee getting the data back — in 20% of cases, the decryption key doesn't fully work.
IT recovery without a backup means hours of external consultancy to investigate the attack, reinstall operating systems, reconfigure the network, clean out the malware and possibly recover some of the data. The estimated cost for a company with 10–20 workstations: €5,000–30,000, depending on complexity.
Compromised hardware is sometimes beyond recovery — infected routers, encrypted NAS devices, computers with modified firmware. Fully replacing the infrastructure for 10 workstations can exceed €15,000.
Indirect costs: what doesn't appear on the invoice
According to Coveware data (Q4 2024), the average downtime after a ransomware attack for an SME without a recovery plan is 21 working days. During that time:
- Staff can work only inefficiently or not at all — salary costs with no productivity
- Fixed-deadline contracts are missed — penalties and lost clients
- Invoicing is blocked — negative cash flow
- The company's reputation suffers — clients find out, sometimes publicly
For a company with 8 employees and revenue of €80,000 a month, 21 days of partial downtime means at least €35,000–50,000 in lost revenue, excluding recovery costs.
On top of that comes long-term client loss. Sensitive sectors — accounting, healthcare, legal — run on trust. A security incident can lead to losing 10–25% of the client base in the following months.
Legal costs: the GDPR and the data protection authority
If the attack involved personal data of clients or employees (and in 90% of cases it does), your company has strict legal obligations within 72 hours:
- Notifying ANSPDCP (Romania's National Supervisory Authority for Personal Data Processing)
- Notifying the people affected if the risk to their rights is high
- Documenting the incident in the internal register
Failing to notify within 72 hours can lead to fines of up to €10 million or 2% of global annual turnover. For an SME, even a minimum fine of €5,000–20,000 can be devastating.
Legal advice for managing a GDPR crisis: €2,000–8,000 for an average incident. PR consultancy to limit reputational damage: another €3,000–10,000.
Compared: with backup vs without backup
| Cost category | Without professional backup | With BackupFirma backup |
|---|---|---|
| Ransom | €50,000–200,000 | €0 (not needed) |
| IT recovery and consultancy | €5,000–30,000 | €500–2,000 (reinstall + restore) |
| Downtime (21 days vs 1–3 days) | €35,000–80,000 in lost revenue | €2,000–8,000 (minimal days affected) |
| GDPR fines and legal costs | €5,000–30,000 | Significantly reduced thanks to the included documentation |
| Client loss (estimated over 6 months) | €10,000–50,000 | Negligible (the incident is resolved quickly) |
| ESTIMATED TOTAL | €105,000–390,000 | €2,500–10,000 |
What it costs not to be hit: backup vs incident
The figures in the table above are hard to look at. But the hardest part is that they're preventable. A professional backup system for an SME with 5–15 employees costs:
- Entry-level Synology NAS (DS223 or DS723+): €600–1,800, one-off
- Encrypted cloud storage (Wasabi or Backblaze B2): €15–50/month
- Monitoring and management service: €100–250/month
- Total over 3 years: €5,000–13,000
The ratio is simple: protection costs 10 to 30 times less than an incident. And that's without counting the stress, the management hours lost and the psychological impact on the team.
It's no longer a question of "can I afford it". It's a question of "can I afford not to have it".
See also our article on GDPR obligations related to backup to understand the full legal framework, and our packages to see exactly what each solution includes.
Read also
Work out your company's risk — free 30-minute consultation
We show you concretely how exposed your infrastructure is and what protection costs compared with the real risk. No obligation.