How it usually looks
The scenario repeats from company to company. First customers and partners are told there is "planned maintenance" or a "software update". When hiding it is no longer possible, it is cautiously admitted: yes, there was an attack, but everything is under control. In reality, weeks and months go into restoring processes, searching for lost data and rebuilding what had worked for years.
Ransomware, a stolen database, systems down for several days — companies of any size go through this. It is simply embarrassing to admit publicly, so the market sees the true scale only out of the corner of its eye.
Why they hide it
The reasons are clear: fear of losing customers and reputation, reluctance to show weakness to competitors, worry about questions from regulators and partners. As a result the incident is "swept away", no lessons are drawn — and the company stays just as vulnerable to the next hit.
The real scale of the damage
The most worrying part is that damage of hundreds of millions, sometimes a billion rubles, already surprises almost no one. The number of attacks on business in Russia has nearly doubled over the year. Gradually this has come to be seen as an inevitable cost of doing business.
What to do about it
Secrecy does not cure the problem — it preserves it. The healthy practice is the opposite: acknowledge in advance that an incident is possible for anyone, and prepare for it. That means understanding your critical processes, having a recovery plan and fallback options, and after any incident analysing the causes rather than hiding them.
You can understand how resilient your business is right now — with a short assessment that shows your readiness level and main risks.
FAQ
Is it mandatory to report a cyberattack?
For a number of organisations and data types, notifying regulators is required by law. But even where silence is formally allowed, concealment is usually costlier: unexamined causes raise the risk of a repeat incident.
Why is prevention cheaper than recovery?
Recovery means downtime, lost data, fines, customer churn and reputational damage all at once. Preventive measures (assessment, continuity plan, backups, training) cost incomparably less and reduce both the likelihood and the consequences.
Is your team ready for the first hour of a crisis
Plans are tested by scenarios, not by reading. The assessment shows the gaps, the corporate format works them through with your team on your processes.
