Honest question, really. Every time I see articles about computer vandalism or hacking I see these big numbers and don't understand how they are calculated.
* Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number. Plus:
* If the site is disabled or degraded, you can often easily calculate outage costs based on the average volume of revenue the site generates during the outage period. Plus:
* In a high-profile incident, outside professionals will often need to come in, first because insurance and contracts require a full investigation, and second because once a site is compromised you have to assume there are backdoors that will restore access for the attackers in the future. The cost of an external forensics investigation can hit mid-5-figures by itself very easily. Plus:
* A high-profile incident is inevitably going to involve legal fees for the victim.
That's before you get into things like reputation damage, loss of clients/customers/advertisers, &c.
Like I said upthread, $10k-$20k damages for the defacement of one of the largest newspaper websites in the world sounds like a very low figure to me. I don't mean that in a normative sense. I mean, in the positive, descriptive sense, that sounds like less than what these incidents usually actually cost to their victims.
That should be discounted by the amount of time they spent getting their site up to basic good practices, if any. Otherwise it makes hacking the incompetent a greater crime than cracking in to a high-value hard target.
Once you commit a tort, it's generally all on you.
Someone entering your system, which is supposed to be secure, and changing the headline on your front page mean that you'll (if you're sensible) then go and contract an external firm to perform a security audit and find out how the intruders got into your system, what needs to be done to fix it, and why your system had that particular vulnerability to begin with. All of which costs money.
Alternatively, you'll use your own staff to do the same - which isn't free either, since they're now not doing their normal jobs for the duration. If I'm paying you $120,000 to be my sysadmin and then need to pull you off your normal duties to investigate someone entering my systems for a month then that investigation has cost me $10,000. That I was going to be paying you that money anyway isn't really relevant - that was the cost of your time that was used on that investigation.
Public companies are required to report damages over X but when you find their quarterlies after a hacking incident it lists damages < X.
See Sun & Kevin Mitnick. Either these companies are lying to the court, or they are lying to the SEC.
For example I've cleaned up websites with malware infections that ultimately failed to operate (they had errors in their implementation).
The infections thus caused zero direct damage. There was nothing on the front end that changed and no hidden phishing pages were operated, etc.. However the infections nonetheless had to be cleaned up, the source of the infections found, modifications to the sites made (where possible) including increased protections and reporting mechanisms.
It's like losing your keys - locks might need changing, those locks might have multiple keys, etc., the locks might be secure facilities than need to be checked for incursions (eg inventories made) and such ...