IT services provider Cognizant says it expects to lose between $50M and $70M in Q2 due to a ransomware attack in April, from which it has now fully recovered
Context & Ripple Effects
Cognizant's disclosure puts a hard dollar figure on what the related coverage shows is now a routine class of incident: ransomware drove 41% of cyber insurance claims filed in H1 2020, and a CrowdStrike survey found 56% of organizations hit at least once in the prior year. What distinguishes this case is that the victim runs other companies' IT operations, so the blast radius extends past Cognizant's own books to client delivery.
The pattern also repeats within the sector itself: [[a:868530|Infosys McCamish Systems, a fellow consulting and outsourcing provider, later disclosed LockBit stole data on 6M+ people]] in its own ransomware attack — evidence that IT services firms are treated as high-leverage targets because one intrusion touches many downstream customers.
First-order effects
- Cognizant takes a $50M–$70M hit to Q2 results from the April attack, a direct earnings impact it must explain to investors even after declaring full recovery of its systems.
- Clients whose outsourced workloads ran on Cognizant's disrupted internal environment faced delivery interruptions during April, since the vendor's own infrastructure is their supply chain.
Second-order effects
- With ransomware dominating claim volumes and average demands rising, insurers face pricing pressure that flows back to large enterprises like Cognizant as higher premiums and tighter underwriting for cyber coverage.
- Rival outsourcing providers are pushed to audit and publicize their own resilience, because Cognizant's quantified loss gives procurement teams a concrete number to weigh against vendor risk.
Third-order effects
- The corpus shows paying does not end the exposure — 80% of organizations that paid a ransom were hit again — pointing toward structural shifts in how enterprises budget for ransomware as a recurring operating cost rather than a one-off catastrophe.
- If IT services firms keep absorbing nine-figure-scale losses, expect security posture to become a formal differentiator in outsourcing contracts, with buyers demanding audited recovery capabilities alongside price and delivery metrics.
The trend: Ransomware is maturing from an IT nuisance into a material, board-level financial event for large enterprises, with insurers' claims data and repeat-victim statistics reshaping how companies price, insure, and disclose the risk.