What a Cyber Shutdown Cost Three Manufacturers, in Their Own Filings

$2.0 million. That is what Molson Coors reported as the incremental cost of its March 2021 cyber incident for the first quarter, in its 10-Q, net of insurance. Consultants, experts, data recovery. A rounding error for a brewer that size.

Weeks before that 10-Q, the same company had told investors something much larger. Its 8-K of 26 March 2021 estimated that the incident, together with the February winter storms in Texas, would shift 1.8 to 2.0 million hectolitres of production and shipments, and $120 million to $140 million of underlying EBITDA, out of the first quarter and into the rest of the year. The filing does not split that estimate between the storms and the incident, so neither can we. What it does show is the shape of the problem: the cost line was small, and the production line was not.

That shape repeats in two more filings. This piece reads all three side by side, using only what the companies filed with the SEC or said on the record, and then hands you a one-page worksheet that does the same arithmetic for your own site. It is written for whoever has to defend exercise time in a budget meeting: an OT security lead, a plant manager, an engineering director.

A caution before the numbers. Larger figures for two of these incidents circulate online. We could not find them in any filing, so they are not here.

Three filings, one table

Where the filings say what the incident-cost line covers, it is mostly outside help: forensics, recovery, consultants. The lost production days land in net sales and volume, which no income statement labels "cyber".

A second pattern matters more for your worksheet. Whether the lost output came back depended on spare capacity. Molson Coors described its volume as shifted, not lost. Clorox's fiscal 2024 10-K says some of the first-quarter sales it missed were recognised later in the year "as customers rebuilt inventories". Brunswick could not do that. Its 8-K of 19 July 2023 said the lost production of high-horsepower outboard engines would be difficult to compensate, with the plants running full for the rest of the year:

we plan to be in full production for the balance of the year with limited ability to overdrive

Nine days to get every primary plant back, by Brunswick's own count. Days that a full order book could not absorb later. That is the number a budget meeting needs, and most sites have never written it down.

The worksheet: what one lost production day costs your site

Pick one line or one unit, not the whole plant. The right-hand column says who to bring.

Here it is with invented numbers, so you can check the arithmetic before you trust it with real ones. A packing line makes 20,000 cases a day (A) at $5 contribution per case (B). With ordering and scheduling down, the crew can hold 20 percent of output by hand (C). Planning reckons 40 percent of the lost cases can be made up later (D), at $1 extra a case (E). Outside help runs $25,000 a day (G).

Units lost per day: 20,000 × 0.8 = 16,000. Each lost case costs $5 × 0.6 + $1 × 0.4 = $3.40. So one lost day is 16,000 × $3.40 + $25,000 = $79,400. At a guessed five days, the exposure is $397,000. If the real restart is ten days, it is $794,000.

Look at which input moved the answer most. Not the contribution margin, which finance knows to the cent. The restart days, which nobody has timed. Set D to zero, the Brunswick case, and each lost case costs the full $5, and the day climbs to $105,000. Does your planner know whether your D is closer to 0.4 or to zero? If not, fix D first. It costs one phone call.

"Exercises don't stop attacks"

I'd rather put the money into detection. A tabletop never blocked a single packet, and I'm not going to pretend otherwise to finance.

Correct, and the worksheet agrees with you. It does not price prevention at all. It prices days, and the two inputs most sites guess are F, restart days, and C, the manual rate. Those are exactly what an exercise measures. A technical tabletop walks the restore sequence against a clock. A manual-operation drill finds out whether the crew can hold 20 percent or 5 percent with the screens dark.

So the honest pitch is narrower than "exercises reduce risk". It is: we are spending a half day to replace two guessed numbers with timed ones, and one of those numbers multiplies everything else on the sheet.

"We have never been hit"

Twenty years on this site and nothing has touched the control system. I'm not taking a hypothetical disaster to the finance committee and asking for money against it.

The worksheet does not ask you to. It has no probability in it. It asks what a day is worth, which is a fact about your plant whether or not anything ever happens.

The filings add something sharper. None of the six filings we read describes an attack on plant control systems. Clorox reported unauthorized activity on its IT systems and, by its own 8-K, took certain systems offline to contain it. Its next 10-Q describes the fallback: manual ordering and processing "at a reduced rate of operations". Brunswick's first disclosure called it an IT security incident and said the company had paused operations at some locations. The disruption reached production through business systems and through the response itself: Clorox lost automated order processing, and Brunswick paused operations while it found out what had happened. A control system that was never touched does not keep a line running when nobody can release an order to it.

Is your manual rate, input C, measured or remembered? If someone measured it in the last year, skip ahead to insurance.

"Insurance covers it"

We pay for cyber cover precisely so I don't have to fund this twice. If the plant stops, the policy pays.

Look at where the insurance appears in these filings. Molson Coors' $2.0 million is already net of insurance recoveries; the shifted hectolitres sit elsewhere. Clorox recognised no insurance proceeds through 31 December 2023, then booked recoveries of $30 million in the April to June 2024 quarter, eight to ten months after the attack, and reported the cost net of those recoveries at about $29 million. In the filing, the recovery sits against incremental costs. No line in it sets a recovery against the 20 percent drop in first-quarter sales.

The same company's annual report put the general point in its risk factors:

costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of its cybersecurity insurance policy

Boilerplate, but the company's own boilerplate. The worksheet gives you the figure to hold your policy against.

What the three filings agree on

A manufacturer's cyber incident is filed as two numbers, and the smaller one gets the label. The bigger one is days: days the line ran at a manual rate, days the order book could or could not absorb, days until every plant was back. Those days are priced by facts you can collect this week, and the only input that is usually a guess is the one an exercise exists to measure.

That is the business case for exercise time, and it is a narrow one. Not "drills stop attacks". Not "drills would have saved Clorox". Just this: one lost day here costs a number we can now say out loud, and we do not know how many of them a restart takes.

Sources: Molson Coors, 8-K exhibit 99.1, 26 March 2021 | Molson Coors, 10-Q for Q1 2021 | Clorox, 8-K, August 2023 | Clorox, 10-Q to 30 September 2023 | Clorox, 10-Q to 31 December 2023 | Clorox, 10-K for fiscal 2024 and its exhibit 99.1 | Brunswick, 8-K, 13 June 2023 | Brunswick, 8-K, 19 July 2023 | Brunswick, 8-K, 27 July 2023 | The Record, "Marine industry giant Brunswick lost millions", August 2023