2 of 45

Table of Contents

Introduction
Economic Impact of Cybercrime to Ireland
Economic Impact of the HSE ransomware attack of 2021
The Cost of Cybersecurity for Ireland
Interview with Mark Lane, Lecturer in cybersecurity at TUD
Cost of cybersecurity for everyday people
Survey on Cybersecurity for everyday people
Impact of Cybercrime on the UK
The Economics of Cybercrime for Russia
Economic Impact of Cybercrime on the Russian-Ukraine War
Cybercriminal bosses
Russian ransomware
The Economics of Ransomware
Economics of large Cyberattacks worldwide
The impact of AI on cybersecurity
The impact of AI on cybercrime
Global Goals
Major Cyberattacks during 2024
Conclusion
Reflections
References

3 of 45

Introduction

For this project we wanted to investigate the economic impact of cybercrime on the world, given the scale of cyberattacks that have occurred in the past few decades and the damage they have caused. In most cases, cybercrime is for economic benefits and victims of it suffer economic losses. Our aim for this project is to find out the economic cost of cybersecurity and the income that cybercrime generates cybercriminals. We are also interested in the main countries involved in cybercrime, and the differences between them. From an economic perspective, we will investigate the impact cybercrime has had on corporations, governments and wars. There has been a significant increase in cybersecurity training and software available in the past decade, so we wonder whether there will be an evolution from artillery in international conflict, to cybercrimes behind a computer screen. There have been countless large-scale cyber-attacks in recent years and the income it provides cybercriminals is a huge problem and is something that will need to be rectified or the cyberattacks will continue.

4 of 45

Economic impact of Cybercrime to Ireland

In 2020, in Ireland alone, there was a total cost of €9.6 billion for cybercrime. This was a period during lockdown in which many people were at home, using online credit cards for online shopping. Also, workers of large corporations, including cybersecurity workers were forced to work from home which has limitations. Businesses were exploited significantly in this year and there was a huge increase from 2019 to 2020 in cybercrime. There was a 55% increase in online fraud from 2019 to 2020 which may have been a combination of an increased number of people buying online due to lockdown and there being an increase in workers resorting to cybercrime organisations in foreign countries, most notably, Russia. There was also a 45% increase in the number of phishing complaints from 2019 to 2020 in Ireland, a significant increase.

5 of 45

Economic Impact of Cybercrime to Ireland

The most common cyberattack is ransomware which increased from approximately €995 million in 2014 to over €2 billion by 2020 in Ireland alone. Between 2020 and 2021, there was a 1,318% increase in ransomware attacks which conveys the destruction that ransomware is causing. There was an 86% increase in online investment fraud total from the same period in 2020 to 2021. A study from Hiscox Insurance found that out of 300 Irish businesses surveyed, 43% of them experienced at least one cyber-attack, which equates to 129 businesses out of the 300. In 2023, a study from Grant Thornton Ireland revealed that 59.2% of businesses surveyed had experienced a cyber-attack in the past year and unfortunately almost 20% of businesses surveyed didn’t have cybersecurity measures in place.

6 of 45

Economic Impact of the HSE ransomware attack of 2021

One of the most famous cyberattacks in Ireland came in 2021, when the HSE was subject to a ransomware attack which had an estimated cost of €102 million and that they had suffered 473 data-protection lawsuits against them. It is estimated that the HSE would need to spend €657 million on cybersecurity upgrades. The group known to have been responsible for the attack were identified as ‘Wizard Spider’, a group believed to have been operating out of Russia. While the vaccination records were not affected, 700 GB of unencrypted data had been taken. This included PHI (Protective Health Information).The cost of cybercrime in Ireland is massive, and cybersecurity measures must be put in place among both the private and public sectors.

7 of 45

The Cost of Cybersecurity for Ireland

An indirect way to increase the number of businesses investing in cybersecurity is to fine them if they breach the General Data Protection Regulation (GDPR). The structure was set up in 2018, for EU countries and the UK and have increased the maximum fine in Ireland for data protection breaches of €100,000 to €20 million, a massive increase. This means that businesses are realising that it isn’t the direct cost alone that a cyber-attack may inflict, it’s the added costs such as GDPR breaches that boost the cost. The result of the new structure means that businesses have increased their cybersecurity measures. In October 2024, a Cyber Security Review Grant was announced for Irish businesses, which is a partnership between Enterprise Ireland and the NCSC. The grant allows businesses 80% of a fixed project fund of €3,000 for cybersecurity measures which can help protect them against future attacks. The grant was operated on a first come, first served basis which meant that businesses had to act fast if they wanted funding.

8 of 45

The Cost of Cybersecurity for Ireland

The threat cybercrime poses to businesses around Ireland has had a potent impact on their annual budgets. A PWC Ireland CEO survey revealed that 90% of Irish businesses feel that they are vulnerable to cyber-attacks. The study also revealed that 69% of Irish businesses are increasing their cybersecurity budgets, in comparison to the world average of 80%. A common conception of incoming government legislation will be that the new Irish government will undoubtedly introduce new legislation for Irish businesses. Cybersecurity is becoming a vital cost for the government, considering the consequences for businesses around the country.

9 of 45

The Cost of Cybersecurity for Ireland

The Irish government set out to improve cybersecurity in 2015 with the ongoing crisis of cybercrime, putting government databases at risk. The National Cyber Security Centre (NCSC) was established and works to help the government protect their critical data from external attacks. In February 2021, the government announced that it would spend €193 million on cybersecurity research, artificial intelligence, data privacy and ethics. The 2024 National budget included a €10.7 million investment in the National Cyber Security Centre (NCSC) which will allow for increased funding into cybersecurity in both the private and public sector.

10 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

As part of our research into this project, we interviewed Mark Lane, lecturer in cybersecurity at the Technological University of Dublin (TUD) and founder of Zerodays CTF, which for the last 10 years has brought young people all over Ireland into the cybersecurity scene. We wanted to hear his input into the importance of cybersecurity and how businesses across Ireland are vulnerable if the investment into cybersecurity isn't made. We asked him five questions about the most important aspects of cybersecurity in Ireland. We would like to sincerely thank Mark for taking his time to answer our questions.

11 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

1. Are cyberattacks becoming a threat to the Irish government?

Yes, cyberattacks are an increasing threat to the Irish government. In recent years, Ireland has experienced a sharp rise in cyber incidents targeting government agencies and critical infrastructure. One of the most high-profile attacks was the 2021 ransomware attack on the Health Service Executive (HSE), which disrupted healthcare services nationwide and cost the government millions in recovery efforts. This attack demonstrated how cybercriminals are not just targeting businesses but also public institutions, leading to potential risks for national security, economic stability, and public safety.

Additionally, Ireland’s growing digital economy and role as a European tech hub make it an attractive target for both cybercriminals and state-sponsored actors. Government agencies manage vast amounts of sensitive data, and any breach could have severe consequences. While steps have been taken to improve national cybersecurity, including the establishment of the National Cyber Security Centre (NCSC), continuous investment in defensive capabilities, training, and public-private collaboration is essential to counter this evolving threat landscape.

12 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

2. Is the Irish government investing enough into cybersecurity?

While the Irish government has made progress in strengthening national cybersecurity, current investment levels still fall short of what is required to adequately defend against increasingly sophisticated cyber threats. The National Cyber Security Strategy 2019-2024 outlines Ireland’s approach to improving its cyber resilience, but critics argue that funding and resources remain insufficient, particularly when compared to other European nations.

For example, in 2023, the Irish government allocated €22 million to the National Cyber Security Centre (NCSC)—a significant increase from previous years but still relatively low compared to the UK’s £2.6 billion National Cyber Strategy investment. Cybercriminals and nation-state actors are continuously evolving their tactics, and without substantial long-term funding, Ireland risks falling behind in its ability to protect critical infrastructure, businesses, and government systems. Increased investment in cybersecurity talent development, public-private partnerships, and proactive threat detection measures is essential to ensure Ireland remains resilient against cyber threats.

13 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

3. Which country poses the biggest threat to Irish businesses?

While cyber threats can originate from anywhere, Russia and China are often cited as the biggest state-sponsored cyber threats to Irish businesses, particularly in sectors involving sensitive data, finance, and technology. Russia has been linked to cyber espionage campaigns targeting European countries, and with Ireland being home to key global tech and financial services companies, it is an attractive target for intelligence gathering and disruption.

China, on the other hand, has been accused of engaging in cyber espionage to steal intellectual property and trade secrets from businesses worldwide. Given Ireland’s role as a major hub for multinational corporations, particularly in pharmaceuticals, software, and finance, Chinese cyber actors may seek to exploit vulnerabilities in these industries.

However, it’s not just state-sponsored threats that Irish businesses need to worry about—cybercriminal groups from around the world, including Russia, Eastern Europe, North Korea, and beyond frequently deploy ransomware and phishing attacks against Irish firms. The Conti ransomware gang, for instance, was linked to the devastating 2021 HSE cyberattack. In short, Irish businesses face cyber risks from multiple international actors, and robust cybersecurity measures are critical to mitigating these threats.

14 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

4. Do Irish businesses need to be made more aware of the threats cyber-attacks can pose?

Absolutely. While awareness of cyber threats has improved in recent years, many Irish businesses, particularly SMEs (small and medium-sized enterprises), remain underprepared for cyberattacks. According to research, a significant percentage of Irish companies lack adequate cybersecurity measures, making them easy targets for ransomware, phishing, and data breaches. Many business owners believe they are “too small” to be attacked, but cybercriminals often target SMEs precisely because they tend to have weaker defenses.

More needs to be done to educate Irish businesses on basic cybersecurity hygiene, incident response planning, and threat awareness. The government and industry groups should work together to provide accessible training programs, resources, and incentives for businesses to invest in cybersecurity. Initiatives like Cyber Ireland and the National Cyber Security Centre (NCSC) could play a bigger role in driving awareness. Without proactive education and investment in cybersecurity, many Irish businesses remain at serious risk of financial and reputational damage from cyber incidents.

15 of 45

Interview with Mark Lane, Lecturer in cybersecurity at TUD

5. What is the most cost-efficient method of cybersecurity for low-profile Irish businesses with small budgets?

For low-profile Irish businesses with limited budgets, implementing cybersecurity best practices doesn’t have to be expensive—many effective measures are low-cost or even free. The most cost-efficient approach involves a combination of basic security tools, employee training, and common-sense cyber hygiene practices.

Enable Multi-Factor Authentication (MFA): MFA is one of the simplest and most effective ways to prevent unauthorised access to accounts. Many platforms, including email providers and cloud services, offer it for free.
Use Strong Passwords and a Password Manager: Encourage employees to use unique passwords and store them securely with free or low-cost password managers like Bitwarden or LastPass. Practice good password hygiene and enforce password policies.
Keep Software Updated: Regularly updating operating systems, applications, and security software helps patch vulnerabilities before they can be exploited.
Install a Free or Affordable Antivirus Solution: Tools like Windows Defender (built into Windows) or free versions of Avast and Bitdefender provide decent protection against malware.
Implement Regular Data Backups: Use cloud-based or external hard drive backups to ensure critical business data is recoverable in case of an attack.
Conduct Cybersecurity Awareness Training: Employees are often the weakest link in cybersecurity. Free resources like CyberAware by the UK NCSC or training from Cyber Ireland can help staff recognise phishing emails and other threats.
Limit User Access: Not all employees need access to sensitive company data. Implementing role-based access controls (RBAC) reduces the risk of insider threats. Utilise the principle of least privilege where users are only given the minimum access that they need.
Use a Basic Firewall and Network Security Measures: Many internet service providers offer built-in security features with their business plans. Small businesses can also use affordable firewall solutions like pfSense for added protection.

By implementing these low-cost but highly effective cybersecurity measures, even the smallest businesses can significantly reduce their risk of falling victim to cyberattacks. For those with slightly larger budgets, outsourcing cybersecurity to a managed security provider (MSP) can also be a cost-effective option.

16 of 45

Cost of Cybersecurity for everyday people

Due to the threat of cyber-attacks on everyday Irish residents, there have been various software and apps to have come available to combat cyber-attacks on people's data. However, they come at a price and is another example of how cybercrime has impacted people all around the world. One of the most renowned software tools that combats cyber-attacks is Norton. Norton have a tool that prevents viruses. They will block users from clicking on certain links and will put a green rick beside any website that is ''Norton Safe Search''. However the tool costs people €29.99 per year. Gen Digital is an app that uses AI insights to help people prevent cyber-attacks and keeps their data secure. A study by TechJury in 2023, revealed that 76% of computers worldwide have anti-virus software installed. They also revealed that in 2020, the cybersecurity market had risen to $40 Billion. It isn't just the cyber-attacks themselves that have an impact on people financially. It's the tools they use to combat it.

17 of 45