A story that looks like it's about cybersecurity is really about reputation. The average cost of a single data breach in 2026 reached $4.99 million — roughly 12% more than a year earlier. But the number isn't the point. The point is where the center of gravity of the attack has moved: attackers increasingly don't need the files themselves and increasingly want the ability to strike at trust. According to IBM, 41% of organizations that faced extortionists received a demand for money precisely under the threat of publishing what was stolen. In other words, a breach is no longer just an IT incident "inside the perimeter" — it has become a tool of reputational blackmail. And responding to it with the security team alone means losing half the game.
The news in bullet points: what actually changed in 2026
We open this analysis with dry figures on purpose — because behind each of them sits a management decision, not just a line in a report. Below are the key metrics from the latest breach research and how a reputation specialist reads them, rather than an infrastructure one.
| Metric (2026 data) | What it means for reputation |
|---|---|
| $4.99M — average cost of a breach, +12% year on year | Most of that sum isn't "fix the server" — it's downtime, customer churn and lost trust. The reputational component is growing faster than the technical one. |
| 41% of extortionists lean on the threat of disclosure | The model has shifted from "we encrypted it — pay for the key" to "we stole it — pay, or we publish." This isn't about access to files anymore; it's about your name in public. |
| The main damage is downtime and lost trust, not system recovery | The technical track closes the hole in days; the reputational tail drags on for months and surfaces in search for the company name. |
| The attacker's goal is to speed up and cheapen the pressure | Publishing the database or fragments of it makes the threat "tangible" for customers and the regulator — and raises the odds of payment. |
The figures come from IBM's annual "Cost of a Data Breach" study and its coverage in specialist security media (see, for example, this CISOClub write-up). What matters for this analysis isn't the rising cost itself but the shift in motive: the attack increasingly targets publicity rather than a decryption ransom. And publicity is our territory.
Why this is a reputation story, not just an IT one
The classic logic of breach response is technical: close the vulnerability, reset passwords, restore backups, report to the regulator. All of that is necessary, but it describes only one half of the incident. The second half begins the moment the breach becomes public: industry media write about it, Telegram channels and forums discuss it, fragments of the database get posted "as proof." From that point on, the company's fate is decided not by a patch on a server but by what a customer, partner or bank sees when they type the company's name into search.
That's why we treat a breach as a variety of reputational crisis — with its own protocol, roles and timelines. The logic of the first hours here is the same as for any high-profile incident, and we've covered it in detail in our piece on the first 72 hours of a reputational crisis: who speaks, what they say, and in what order. A data breach is simply one of the most common — and most underestimated — triggers for that protocol.
See also · Crisis management
Reputational Crisis: The SEO Reputation Protocol for the First 72 Hours
What to do in the first three days after a breach or scandal: the parallel legal, PR and SEO reputation protocol, real timelines and typical mistakes — the foundation this analysis builds on.
Read the article →
Double extortion: when they steal not the data but the trust
The scenario behind the "41%" figure is what the industry calls double extortion. It works like this: first the data is exfiltrated, and only then encrypted or locked. The company is then presented with not one but two levers of pressure at once. The first is familiar: "restore your operations by paying for the key." The second is reputational and far more painful: "and if you don't pay, we publish the customer database, the correspondence and the documents." It's the second lever that turns an IT incident into a public one.
The attacker's calculation is simple and cynical: the threat of publication hits exactly where a business has no backup. An encrypted server can be restored from a backup, but a customer database or executive correspondence dumped online can't be "undone." So the pressure is built around publicity: the louder the scandal, the higher the chance the victim pays. We meet the same logic when anonymous channels trade in kompromat — the mechanics of the ultimatum are identical, and we broke them down in our article on kompromat on Telegram. The only difference is that here the blackmailer holds not an "inside scoop" but your own database.
"A data breach long ago stopped being measured only in terabytes and hours of downtime. The real price is what a customer, a partner and a bank will read about you in search a month after the incident. We work with the second half of a breach — the public one: we help you say the right thing at the right moment, keep the stolen material from cementing itself in search for the company name, and restore trust by lawful means. You can't negotiate silence with a blackmailer — but you can make sure their publication isn't what people judge you by."
The reputational response loop: what a business should do
While the security team closes the technical perimeter, a reputational loop has to run in parallel. This isn't about "drafting a nice press release" — it's a managed sequence of steps where each one rests on the last. Skip any of them and you've left the very gap through which an incident grows into a drawn-out crisis.
Preserve and size it up
Exactly what leaked, whose data is affected, whether there's a ransom demand. Save the correspondence with the extortionist as evidence — don't delete it and don't reply on emotion.
The legal track
Notify the regulator within the legal deadline (152-FZ, or GDPR for European data), assess the offences and the risks of paying. Staying silent toward the regulator is a separate penalty.
Communicate with the market
One aligned message to customers and partners: what happened, which data is affected, what's been done, what they should do. Fast, honest and specific — before others tell it for you.
Monitor the public field
Track where the breach and fragments of the database surface: media, Telegram, forums, search for the company name. Early detection decides whether you get to respond in time.
SEO reputation and deindexing
Suppress inaccurate and outdated materials with credible content; deindex unlawfully published personal data on legal grounds — so the negativity never cements in the top results.
Note the order: communicating with the market (step 3) must not outrun the legal assessment (step 2), or a public statement can hurt you in court and with the regulator. But you can't drag it out either — the vacuum is instantly filled with other people's versions. The balance between "say it fast" and "say it precisely" is the most delicate part of the whole job, and it's exactly what you can't improvise on the day of the incident.
Five mistakes that turn an incident into a crisis
Most breaches become a public catastrophe not because of the hack itself but because of how it's handled in the first days. Here are five decisions that almost guarantee a worse position.
| Mistake | What it leads to |
|---|---|
| Stay quiet and hope no one notices | When people learn it from a leaked database rather than from you, you look like you were hiding it. That destroys trust more than the breach — plus a penalty for late notification. |
| Pay the ransom "to close the matter" | There's no guarantee the data is deleted, and you're now marked as a company that pays. The typical result is repeat demands and the database resold. |
| Put out a statement on emotion, without a lawyer | The words from your first press release are later quoted by the regulator, the court and journalists. An imprecise phrase becomes the main argument against you. |
| Reduce it all to tech and "forget" about search | The server was fixed in a week, but the news and posts about the breach cemented in the top results for years — working against every future deal. |
| Respond in a scattered way, without one center | Security, legal, PR and management speak out of sync — contradictions and leaks emerge from the company itself. You need one command post and one fixed position. |
Service
Corporate Reputation Management
Discuss →
Where AEGIS fits in
The technical perimeter of a breach is your security team's or cybersecurity contractor's responsibility, and we don't stand in for it. Aegis Reputation Lab covers the second half of the incident — the public one. We help build communications so they work for trust rather than against it, run mention monitoring for the company name and its beneficiaries to catch a surfaced database fragment or a wave of publications before they cement, and launch suppression and deindexing when inaccurate or unlawfully published material has already reached the results.
The best time to build this loop is before the incident, not on the day a ransom email lands in your inbox. A pre-written notification template, assigned roles, monitoring in place and knowing who to call for legal and SEO reputation support turn panic into a manageable procedure. To understand where your profile is weak and which queries a breach will hit first, it helps to start with a general reputational risk map — and from there we help close the gaps we find, by lawful means and with confidentiality preserved.
Frequently asked questions
Both — but the point of maximum damage has shifted toward reputation. According to IBM's 2026 data, the average breach costs $4.99 million, and most of that sum isn't system recovery but business downtime and the loss of customer and partner trust. The technical loop (close the hole, restore access) is handled by your security team, but a reputational loop has to run in parallel: how and what you say to customers, regulators and the market, and what you do with the fact of the breach in search results and the media. Run only the technical track and the incident almost inevitably turns into a drawn-out reputational crisis.
Double extortion is when an attacker not only encrypts or steals data but also threatens to publish it unless the company pays. According to IBM, 41% of organizations that faced extortionists received demands specifically under the threat of disclosure. Paying almost never closes the matter: you have no guarantee the data will be deleted rather than resold, and the very act of paying marks you as a company that pays, opening the door to repeat attacks. On top of that, in many jurisdictions paying certain groups carries legal risk in itself. The right path is preserving evidence, notifying the regulator as required by law, working with lawyers and having communications ready in advance — not negotiating a ransom.
Silence almost always costs more. First, notification is often legally required (Russia's 152-FZ, the EU's GDPR) within tight deadlines, and failing to do so is a separate penalty. Second, if people learn of it not from you but from a leaked database or a publication, you lose control of the wording and look like you were hiding the problem — and that destroys trust more than the breach itself. Experience shows that those who win communicate fast, honestly and specifically: what happened, which data was affected, what's already been done and what the customer should do. But the text of such a message can't be written on emotion — it's simultaneously a legal document, a PR statement and a future search result for your company's name.
A high-profile breach almost always surfaces in branded search: news notes, write-ups in industry media, posts on Telegram and forums, and sometimes fragments of the database itself. Within a few weeks it's precisely these materials that shape the first impression of the company for customers, partners and banks who check you before a deal. That's why the response includes an SEO reputation loop: monitoring what gets indexed for your name, suppressing inaccurate and outdated materials with credible expert content, and deindexing unlawfully published personal data on legal grounds. This has to start in the first days, not six months later when the negativity has already cemented itself in the top results.
Yes. The average breach cost in the IBM report is an average across large organizations, but the relative blow to a small or mid-sized business is often heavier: a small company has no cushion to survive customer churn and a regulator's inquiry. And a basic reputational loop doesn't require a corporate budget: a pre-written notification template, roles assigned in case of an incident, mention monitoring in place, and knowing who to call for legal and SEO reputation support. It's cheaper to build this loop in advance than to assemble it in a panic on the day of the breach.
See also
Crisis management
Reputational Crisis Management: The SEO Reputation Protocol for the First 72 Hours After a Breach or Scandal
Read the article →
Kompromat on Telegram
Kompromat on Telegram: How to Respond to an Anonymous Leak and Blackmail
Read the article →
Information attacks
Paid Publication and Information Attack: How to Recognize It and What to Do
Read the article →
SEO Reputation
SEO Reputation Management: How to Push Negative Information Out of the Top of Google and Yandex
Read the article →
Risk map