A scenario is a lens.
Not a loss forecast.

THE ORIGINAL MODEL / OCTOBER 2023

What the $3.5trn figure describes.

The Lloyd’s and Cambridge Centre for Risk Studies analysis modelled a hypothetical attack on a major payments system. It estimated five-year global GDP loss, using three severity levels. The release describes $3.5trn as their weighted average, with a $2.2trn–$16trn severity range. Its probability-weighted expected loss is a different measure: $140bn.

The largest country-level losses in the release were the US at $1.1trn, China at $470bn, and Japan at $200bn. Recovery varied with exposure and resilience. These historical model outputs are not a statement of today’s realised losses, insured claims, or what any individual company would lose.

Use the exercise to challenge assumptions. Do not apply a percentage of the global figure to your company’s turnover and call the result a risk assessment.

HOW DISRUPTION TRAVELS

The original illustration describes a widening consequence.

The accompanying Lloyd’s scenario brief moves from a malicious software update, through payment disruption and compromised records, to recovery work and loss of confidence. This is a constructed narrative, not a reconstruction of a known attack.

Its value is the distinction between availability and integrity. Getting a service back online is one problem. Knowing which transactions are valid, which were duplicated, and which balances can be trusted is another.

Bring finance and operations into the discussion early. A recovery plan centred only on restoring servers may have little to say about an incomplete settlement, an unprocessed payroll file, or an order released twice.

APPLY IT TO YOUR BUSINESS

Follow one essential payment from instruction to reconciliation.

Choose a transaction that matters: payroll, a large supplier payment, customer card receipts, or a settlement supporting daily operations. Identify the bank, platform, connectivity, approval, and records on which it depends.

Ask how long the business can continue if the payment is delayed. Cash in the bank is not necessarily usable cash if the normal channel is unavailable. Equally, a manual alternative may introduce fraud, duplication, or control failures.

• Before disruption: record essential payment dependencies, accountable contacts, and authorisation limits.
• During disruption: define which transactions take priority and which work must pause.
• After restoration: reconcile outstanding instructions, verify balances, and resolve exceptions before declaring normal service.

Discuss the arrangement with the provider rather than assuming a different portal or second account avoids the same underlying dependency. A fallback earns its place by working under the conditions you are preparing for.

MANAGEMENT & INSURANCE

Prepare for the gap between technology recovery and business recovery.

Give the scenario a clear business boundary and a decision-maker. Set an interruption assumption, agree a minimum service, and test the information needed to authorise exceptions. Record which parts of the plan were demonstrated and which remain untested.

Insurance can form part of the response to financial consequences, but an aggregate economic-loss estimate says nothing about the cover in your policy. Review relevant triggers, exclusions, waiting periods, limits, and supplier dependencies with the appropriate adviser.

Keep this as a dated model in board papers. Refresh your actual dependency information and test results as suppliers, transaction volumes, and working practices change.