Security incidents can harm lives, livelihoods, privacy, services and trust, with different effects for different people.
After a violent attack, a station closes while emergency teams respond. Injured people need care, commuters cannot use the route and nearby shops lose customers. One incident can have several connected effects.
Terrorism can cause deaths, injuries and damage. Fear may change everyday behaviour, while disruption and recovery create economic costs. Rumours or collective blame can add social harm by increasing distrust between communities; those reactions are not inevitable.
Cyber incidents can expose personal information, lead to financial loss, alter important records or interrupt services. Effects may spread when many organisations rely on the same system. A loss of privacy matters even if services keep running, and exposure creates risks rather than proving that every victim will suffer further loss.
Keep the evidence specific: who was affected, what happened, how widely and for how long? An audit examines evidence to assess what happened; this can include logs, which record system activity. Separate observed harm from a possible future consequence. A serious incident does not necessarily have every kind of impact, and a successful recovery does not undo all earlier harm.
Worked example: Data copied while the shop stays open
Attackers copy an online retailer's customer contact details. The shop continues taking orders. It pays for an investigation and notifies customers. Several customers say they now feel less confident about sharing information with it. There is no evidence that their money was taken.
- Copied personal information establishes a loss of data privacy even though the shopping service remains available.
- The investigation creates a cost for the business, and the customers' accounts provide evidence of reduced trust among those speakers.
- Stolen contact details could enable later deception, but that risk does not prove that a financial loss has already occurred.
- Continuing sales therefore do not mean there was no harm. Equally, the evidence does not establish lost money or reduced trust among every customer.
Watch out for this
Once a service is running again, all the harm from a security incident has ended.
Restoration addresses service availability. Earlier losses, exposed information, fear or damaged trust can remain and may require separate support or action.
Check your understanding
A transport operator confirms that an attack copied customer contact details but says journeys continued normally. Which conclusion is justified?
- There was no harm because the vehicles kept running.
- All customers must already have lost money.
- The incident harmed data privacy without a reported interruption to journeys.