The answer depends on what counts as a cost. A global computer worm can generate billions of dollars in estimated cleanup and lost productivity across many organizations. A breach at one company produces a narrower, often better-documented bill. The ranking below uses commonly cited nominal dollar estimates to compare both kinds of attack. It is a guide to their reported economic scale, not an audited league table: estimates for older worms are especially uncertain, and the figures have not been adjusted for inflation.
1. MyDoom: approximately $38 billion
First detected in 2004, MyDoom spread through email attachments and infected computers at remarkable speed. It also enabled distributed denial-of-service attacks, in which many compromised machines overwhelm a target with traffic.
The often-cited $38 billion figure represents an estimate of worldwide damage, including disruption and recovery work, rather than money stolen by the attackers. Its scale illustrates how a self-propagating attack can impose small costs on enormous numbers of victims, though the precise total is difficult to verify.
2. Sobig: approximately $37.1 billion
The Sobig family of email worms circulated in 2003. Its best-known variant, Sobig.F, spread through infected messages and helped turn compromised computers into a distribution network for further malicious activity.
The frequently quoted $37.1 billion estimate combines broad assumptions about infection, lost productivity, and cleanup. As with MyDoom, it should be read as a historical model of global impact, not as a documented bill paid by one organization.
3. Klez: approximately $19.8 billion
Klez began spreading in 2001 and remained troublesome in 2002. Variants exploited weaknesses in email software and could disguise a message’s apparent sender, making infected mail harder for recipients to recognize.
Its commonly cited cost of about $19.8 billion reflects the cumulative burden of a widespread outbreak: removing infections, restoring systems, and dealing with interrupted work. The estimate is widely repeated but lacks the precision of a modern company’s reported expenses.
4. Sasser: approximately $18 billion
Sasser emerged in 2004 and exploited a vulnerability in Microsoft Windows. Unlike the email worms above, it could spread between vulnerable computers without someone opening an attachment. Its effects included crashes, restarts, and operational disruption at businesses and public services.
An estimated global economic toll of roughly $18 billion is frequently linked to the outbreak. Even in cases where damages defied precise quantification, the takeaway remained unmistakable: unmitigated vulnerabilities could enable malware to spread more rapidly than enterprises were able to react.
5. ILOVEYOU: approximately $15 billion
The ILOVEYOU worm appeared in 2000 as an email attachment accompanied by an enticing message. When opened, it spread through the victim’s contacts and damaged or replaced certain files. Organizations around the world had to disconnect email systems and clean infected computers.
Estimates of its damage vary substantially; $15 billion is a commonly cited upper-end figure, not a settled accounting result. The attack remains a defining example of how a simple social-engineering lure can amplify a technical threat.
6. NotPetya: approximately $10 billion
In 2017, NotPetya struck. It initially propagated via tainted updates within popular Ukrainian accounting packages, subsequently sweeping across enterprise networks. Even though it mirrored ransomware, its catastrophic architecture meant numerous targets could not restore their information through extortion payments.
The White House estimated worldwide losses at more than $10 billion. Global businesses suffered major damage: shipping company Maersk reported rebuilding large parts of its technology infrastructure, while other multinational firms faced disrupted production and distribution. Unlike many older worm estimates, NotPetya’s total is supported by substantial publicly reported losses from individual companies, although the full global cost remains an estimate.
7. Conficker: approximately $9 billion
Discovered in 2008, Conficker exploited a Windows vulnerability and built a large network of infected computers. It also used techniques that made removal and containment difficult. Its persistence forced organizations to spend time identifying vulnerable machines, applying updates, and cleaning infections.
While a figure approaching $9 billion is frequently cited regarding its global footprint, the foundation behind that specific sum lacks transparency. Conficker unquestionably warrants inclusion among major economically impactful breaches, yet its exact position within cost hierarchies remains considerably harder to pin down.
8. WannaCry: approximately $4 billion
During 2017, the WannaCry ransomware propagated swiftly through the exploitation of a security flaw in Windows. Although it encrypted data and demanded ransoms, the greater financial damage stemmed from halted business operations and subsequent remediation costs.
The United Kingdom’s National Health Service turned into one of its most prominent casualties, suffering widespread disruptions to appointments and services. Global losses are frequently estimated at approximately $4 billion, which reflects the overall impact rather than any ransom money delivered. This distinction is significant: while perpetrators gather relatively modest amounts, those targeted face massive expenses.
9. Change Healthcare: approximately $3.1 billion in reported 2024 impact
A 2024 ransomware attack on Change Healthcare disrupted a major part of the United States health payment and claims system. Providers struggled with billing and cash flow, while patients and organizations faced uncertainty about exposed information.
Parent company UnitedHealth Group reported roughly $3.1 billion in 2024 cyberattack-related impacts. That figure is a company-reported financial measure, making it different from the modeled worldwide estimates above. It also does not capture every downstream cost borne by hospitals, medical practices, and patients.
10. Code Red: approximately $2.6 billion
Code Red spread in 2001 by exploiting a vulnerability in Microsoft web server software. It infected vulnerable servers, defaced some websites, and generated traffic intended to overwhelm a target.
Its commonly cited $2.6 billion cost reflects estimates of lost productivity and the work required to protect and repair systems. Like the other early-worm figures, it is best treated as an indication of scale rather than an exact total.
How to read the ranking
These attacks did not all cause loss in the same way. Early worms reached vast numbers of machines, so their headline figures rely heavily on assumptions about time spent cleaning and restoring them. NotPetya combined worldwide spread with severe, documented corporate disruption. Change Healthcare shows how an attack on one critical intermediary can create large costs beyond the company itself.
For that reason, a different method—ranking exclusively audited expenses, adjusting for inflation, or factoring in all indirect costs—would generate a distinct top 10. The underlying theme proves more valuable than the exact sequence: cyber incidents turn out to be costliest whenever they leverage a broadly shared vulnerability or disrupt a service upon which numerous others rely.
