How much were the salaries for people affected by the breach? Consider overtime pay or trades that couldn’t be made during downtime. How much did it cost to replace servers, hard drives, software programs and so on? How much was the value of information employee, shareholder, customer that was stolen or corrupted? How long did retrieving the information cost? What were potential and actual costs of litigating and investigating the incident? How was the cost to your company’s reputation? How did you spend money on a PR campaign?”]
Source: https://www.csoonline.com/article/2113110/criteria-for-determining–the-cost-of-a-breach.html