The answer depends on what counts as a cost. A global computer worm can generate billions of dollars in estimated cleanup and lost productivity across many organizations. A breach at one company produces a narrower, often better-documented bill. The ranking below uses commonly cited nominal dollar estimates to compare both kinds of attack. It is a guide to their reported economic scale, not an audited league table: estimates for older worms are especially uncertain, and the figures have not been adjusted for inflation.
1. MyDoom: approximately $38 billion
First detected in 2004, MyDoom spread through email attachments and infected computers at remarkable speed. It also enabled distributed denial-of-service attacks, in which many compromised machines overwhelm a target with traffic.
The often-cited $38 billion figure represents an estimate of worldwide damage, including disruption and recovery work, rather than money stolen by the attackers. Its scale illustrates how a self-propagating attack can impose small costs on enormous numbers of victims, though the precise total is difficult to verify.
2. Sobig: approximately $37.1 billion
The Sobig family of email worms circulated in 2003. Its best-known variant, Sobig.F, spread through infected messages and helped turn compromised computers into a distribution network for further malicious activity.
The frequently quoted $37.1 billion estimate combines broad assumptions about infection, lost productivity, and cleanup. As with MyDoom, it should be read as a historical model of global impact, not as a documented bill paid by one organization.
3. Klez: approximately $19.8 billion
Klez began spreading in 2001 and remained troublesome in 2002. Variants exploited weaknesses in email software and could disguise a message’s apparent sender, making infected mail harder for recipients to recognize.
Its frequently cited price tag of roughly $19.8 billion illustrates the aggregate impact of a widespread contagion: eradicating infections, repairing networks, and managing halted operations. Although this projection is frequently shared, it lacks the exactness found in contemporary corporate financial disclosures.
4. Sasser: approximately $18 billion
Sasser emerged in 2004 and exploited a vulnerability in Microsoft Windows. Unlike the email worms mentioned earlier, it propagated across susceptible machines without requiring users to open attachments. System crashes, unexpected reboots, and widespread disruption to corporate and public sector operations were among its primary consequences.
An approximately $18 billion worldwide cost is often attributed to the outbreak. The lesson was clear even where losses could not be measured precisely: unpatched systems could allow an infection to travel faster than organizations could respond.
5. ILOVEYOU: approximately $15 billion
ILOVEYOU worm emerged in 2000 as an email attachment featuring a seductive message. Upon being opened, the malware propagated across the victim’s address book while corrupting or overwriting specific files. Enterprises globally were forced to take their mail servers offline and sanitize compromised workstations.
Estimates regarding the extent of the harm differ significantly; $15 billion is a frequently referenced higher-end amount, rather than a finalized financial tally. This assault continues to stand as a prime illustration of how an uncomplicated social-engineering bait can magnify a technical danger.
6. NotPetya: approximately $10 billion
NotPetya struck in 2017. It initially spread through compromised updates to widely used Ukrainian accounting software, then moved through corporate networks. Although it resembled ransomware, its destructive design left many victims unable to recover their data by paying.
The White House calculated worldwide damages at upwards of $10 billion. Major disruptions hit international enterprises: shipping giant Maersk disclosed that massive segments of its tech framework required rebuilding, whereas various multinational corporations encountered halted manufacturing and logistics. Unlike numerous legacy worm projections, the aggregate impact of NotPetya is backed by considerable publicly disclosed deficits from specific businesses, even though the total worldwide price tag remains an approximation.
7. Conficker: approximately $9 billion
First uncovered back in 2008, Conficker leveraged a Windows security flaw to assemble a vast botnet of compromised systems. Furthermore, it relied on sophisticated tactics that complicated containment and eradication efforts. Because of its stubborn persistence, companies were forced to invest significant hours tracking down vulnerable devices, installing patches, and resolving infections.
A figure near $9 billion is often repeated for its worldwide impact, but the basis for that precise amount is not transparent. Conficker belongs on lists of economically significant attacks; its exact placement in a cost ranking is much less certain.
8. WannaCry: approximately $4 billion
In 2017, WannaCry ransomware spread rapidly by exploiting a Windows vulnerability. It encrypted files and demanded payment, but the broader economic harm came from interrupted operations and recovery efforts.
The United Kingdom’s National Health Service became one of its most visible victims, with disrupted appointments and services. Around $4 billion is a frequently cited estimate of global losses, not a measure of ransom paid. The contrast matters: attackers can collect relatively little while victims bear enormous costs.
9. Change Healthcare: approximately $3.1 billion in reported 2024 impact
A 2024 ransomware attack on Change Healthcare disrupted a major part of the United States health payment and claims system. Providers struggled with billing and cash flow, while patients and organizations faced uncertainty about exposed information.
Parent organization UnitedHealth Group disclosed approximately $3.1 billion in financial consequences linked to the 2024 cyberattack. As a metric disclosed directly by the enterprise, this amount differs from the projected global estimates mentioned previously. Furthermore, it fails to account for every secondary expense absorbed by clinics, healthcare facilities, and patients.
10. Code Red: approximately $2.6 billion
Code Red spread in 2001 by exploiting a vulnerability in Microsoft web server software. It infected vulnerable servers, defaced some websites, and generated traffic intended to overwhelm a target.
Its commonly cited $2.6 billion cost reflects estimates of lost productivity and the work required to protect and repair systems. Like the other early-worm figures, it is best treated as an indication of scale rather than an exact total.
How to read the ranking
These attacks did not all cause loss in the same way. Early worms reached vast numbers of machines, so their headline figures rely heavily on assumptions about time spent cleaning and restoring them. NotPetya combined worldwide spread with severe, documented corporate disruption. Change Healthcare shows how an attack on one critical intermediary can create large costs beyond the company itself.
For that reason, a different method—ranking only audited expenses, adjusting for inflation, or including all indirect costs—would produce a different top 10. The common thread is more useful than the precise order: cyberattacks become most expensive when they exploit a widely shared weakness or interrupt a service on which many others depend.
