Businesses are increasingly the target of sophisticated cyber attacks and risk underestimating the “slow-burn” costs of breaches, research from Lloyd’s says.

Ransomware, such as last week’s international cyber attack and the WannaCry virus, is a rising threat, together with distributed-denial-of-service attacks and fraud by criminals posing as CEOs and executives to gain sensitive information.

Immediate impacts such as extortion, IT disruption and loss of business are often outweighed by “slow-burn” costs such as reputational damage, litigation and loss of competitive edge, according to the report, produced with KPMG and law firm DAC Beachcroft.

“The reputational fallout from a cyber breach is what kills modern businesses,” Lloyd’s CEO Inga Beale said.

“And in a world where the threat from cyber crime is when, not if, the idea of simply hoping it won’t happen to you isn’t tenable.”

Regulatory risks are also rising, with new data protection legislation to take effect in Europe from May 25, while a directive for essential digital infrastructure will be incorporated into individual EU country laws next year.

“While the immediate business impact of a breach could be significant for any organisation, it may be only the tip of the iceberg when it comes to dealing with the legal consequences, which may last months or even years,” DAC Beachcroft Head of Cyber and Data Risk Hans Allnutt said.

Cyber crime is estimated to cost businesses $US400 billion ($525.7 billion) a year worldwide, and new threats are emerging all the time. The analysis shows financial services businesses are the most targeted by organised cyber crime, but retail is increasingly hit.

Data on cyber breaches remains relatively sparse, with many organisations reluctant to disclose attacks.

“One lesson is clear, though: by reacting swiftly to mitigate the impacts of a cyber breach once it has occurred, thereby minimising immediate costs, companies could reduce their exposure to subsequent slow-burn costs,” the report says.