What would a systemic cyber-attack cost the UK economy? We recently conducted a study for the Department for Science, Innovation and Technology (DSIT) to answer that question. The findings show the scale of potential disruption and underline why resilience planning matters.
Quantifying the cost of cyber-attacks to the UK economy is a challenging exercise. There is no single consensus methodology, and impacts vary widely depending on the attack vector, point of vulnerability and the attacker’s objectives.
For this study, we worked with Department for Transport (DfT) and Network Rail to model a plausible systemic attack scenario: a cyber-attack on the train communications system leading to rapid system degradation and ultimately a total loss of service across the rail network.
What could a systemic cyber-attack like that cost the UK economy?
Our modelling estimates a total economic impact of approximately £1.8 billion for one week of disruption, including:
- Direct cost to Network Rail: approximately £123 million
- Passenger delays: approximately £281 million
- Gross Value Added (GVA) impact: up to £1.4 billion (≈2.8% of weekly GDP; ≈0.05% annual GDP)
(See full breakdown in the DSIT report.)
Could this really happen?
Systemic disruption would require several conditions to align — making such an event rare under current circumstances. Strong security controls and national policies have helped reduce systemic risk. However, cyber maturity remains uneven across the rail ecosystem, and a compromise in one organisation could still cascade to others.
To assess this, the DSIT study used the European Systemic Risk Board (ESRB) framework, which looks at four stages:
- Context: the structure of the sector and how organisations depend on each other.
- Shock: the initial cyber incident that triggers disruption.
- Amplification: knock-on effects that spread the impact through suppliers, operators and confidence channels.
- Systemic event: the point where disruption becomes widespread and affects the economy.
Based on this approach, a systemic event would need multiple amplifiers to line up — but uneven resilience and geopolitical uncertainty mean the risk cannot be ignored. Recent UK and European incidents have mostly hit ticketing systems, causing isolated financial impacts rather than network-wide outages. In contrast, in conflict zones such as Ukraine and Russia, rail operators have been targeted by state-sponsored groups and hacktivists — showing how context can change the scale of impact.
What this means for rail organisations
The DSIT study highlights two critical points:
- The economic stakes are significant. A single systemic event could cost billions and disrupt essential services.
- Risk is dynamic. Even if systemic events are rare today, the conditions that enable them can change quickly.
For rail operators, this means understanding where your organisation sits in the risk chain and how a local incident could propagate. That insight is critical for prioritising investment and resilience measures.
Find out more
Our DSIT report sets out the potential economic impact of a systemic cyber incident in the rail sector and explains how disruption could spread through critical infrastructure. It provides a useful reference point for organisations assessing their own resilience.
What stands out is the scale and complexity of the risk. A single systemic event could cost billions and disrupt essential services — and while rare, the conditions that enable such events can change quickly.
To understand the financial exposure specific to your own organisation, we encourage you to explore our Cyber Risk Quantification (CRQ) Accelerator, which uses our Cyber Risk Insights (CRI) platform to generate clear, actionable financial insights in just six weeks.
Reach out to the team for a free demo, or if you want support with more confident, data‑driven cyber risk decision‑making.
For those interested in the full research, the DSIT report is available on GOV.UK.
