Product · Hackloss · Global Cyber Loss Analytics
HackLoss.
From severity intelligence to quantified impact
HackLoss delivers high-fidelity, calibrated loss analytics designed for strategic risk management and precise budgetary allocation. We translate worldwide, severity-scored incident data into quantified economic loss, bridging the gap between threat intelligence and the financial data required by the Board.
Inside the platform
Board-ready loss figures for better cyber decisions
Frequency tells you how many attacks happened. It doesn't tell you how much damage they caused, and that is the question a Board has to answer. Hackloss measures the economic loss of cyber incidents worldwide, to support strategic risk management and better-informed budget allocation.
Global loss and distribution Free
Total estimated loss, typical and extreme incidents, and how concentrated losses are in the worst few.
Countries and monthly shocks Free
Where the losses fall, and which months stood out from the trend.
Industries and impact matrix Pro
Loss by industry and technique, and how each industry is hit by each attack type.
Company size and materiality Pro
How large a loss is relative to the revenue range of the company that suffers it.
Techniques, ransomware, DDoS Pro
Loss by attack technique, with deep dives on ransomware and DDoS.
Threat actors by economic impact Pro
The actors behind the attacks, ranked by what they cost their victims.
Latest findings
H1 2026: more incidents, and much larger losses.
Hackloss compares each six-month window with the previous one, so you can see how losses evolve over time, not just how many attacks happened.
Incidents up 55%
12,943 incidents recorded in H1 2026, against 8,346 in H2 2025.
Estimated global loss up 72%
There was an increase in total cost from $15.98 billion in the second half of 2025 to $27.48 billion in the first half of 2026 across the data breach and DDoS tracks.
Although average absolute severity (expressed as ESIX©) remained stable, the average cost of handling incidents increased by 12% compared to the previous semester, growing at different speeds in different geographic areas.
Averages do not tell the story
Hackloss reports typical and extreme incidents separately, and shows how concentrated losses are in the worst few.
The platform is unique in that it provides average, median, P90, P95 and P99 figures for each threat, industry, country and organisation size.
Empirical, not theoretical
Derived from observation, not from thin-sample surveys and abstract models.
Every incident in our database is individually identified, verified, and hand-classified by senior OSINT analysts operating 24/7 across three continents. Our methodology provides a rigorous, empirical quantification of cyber loss across all organizational scales, industries, and threat vectors.
- We track every incident with the same precision, regardless of the victim's size, profile, or geography.
- All loss estimates are fully data-driven, auditable, and transparent.
- Each figure is accompanied by its statistical spread, confidence level, and data recency index, accessible via our API.
- Data Breach and DDoS losses are presented in discrete tracks, to account for their fundamental differences in attack patterns, threat actor behavior, and loss magnitude.
How it works
Three steps from raw incident to calibrated loss.
Hand-Curated Evidence
Many real losses only surface weeks or months after an incident is first reported.
Our analysts revisit and update every incident severity score over time, as new information emerges.
ESIX© Severity Scoring
Each incident is severity-scored using our ESIX© framework, an absolute measure of severity based on the attacker, the target industry, and the technique used, independent of any assumed dollar value.
This gives every incident a consistent severity rating that supports meaningful comparison across different threats and contexts.
Calibrated Financial Modeling
Our Threat Impact Simulator© converts that severity score into a calibrated economic loss by cross-referencing industry, company size, geography, and technique against tens of thousands of previously observed incidents. This replaces synthetic "black-box" models with an evidence-based, auditable inference engine that estimates both typical and extreme-case loss scenarios with empirical precision.
Access
Global Cyber Loss Analytics you can trust
See it for yourself, for free. Then go as deep as your work requires.
The Global Cyber Loss Report
The full semester report, plus four Global Loss sections in the dashboard. Registration required.
Download the free reportPro: the full picture
All twelve sections: industry, technique, company size, ransomware, DDoS and threat actors, with data updated daily.
See Pro plansAPI: constantly updated loss data (also for commercial use)
Real-time queries by industry, country, technique, company size and revenue, each with its statistical spread, confidence level and data recency.
Request API accessFree research
Our Global Cyber Loss Report is free to download.
We believe this publication should not be paywalled, as broad access raises awareness and can drive the action these numbers demand. Free registration required.
Download the reportQuantify cyber loss. Don't assume it.
Granular, up-to-date, calibrated loss figures that support your budget allocation and board reporting needs.