Can a Cyberattack Bankrupt You? The Companies That Didn’t Survive
A cyberattack can bankrupt a company, but almost never through the ransom payment itself. The real killer is the cascade it sets off: (1) operational paralysis — the business cannot invoice, ship, produce or dispense; (2) customer flight — in trust-based B2B a breach ends relationships; (3) direct costs — incident response, rebuild and breach-notification mailings; (4) litigation and regulatory fines — class actions, FTC, state attorneys general, HIPAA/GDPR; and (5) financing collapse — covenant breaches, inability to produce lender reports, investors walking. Each shock is survivable alone; stacked on a thin-margin or already-distressed business they cause insolvency. Real, cited cases: AMCA / Retrieval-Masters (Chapter 11, 2019) collapsed after its four largest clients — Quest, LabCorp, Conduent, CareCentrix — all left following a breach of ~20 million records; National Public Data / Jerico Pictures (Chapter 11, Oct 2024) filed amid ~20 class actions plus FTC and 20+ state actions after a breach that exposed Social Security numbers; KNP Logistics / Knights of Old (UK administration, 2023) — a 158-year-old haulier — collapsed with ~730 jobs lost after an Akira ransomware attack reportedly enabled by one weak password; Stoli Group USA (Chapter 11, Nov 2024) filed after a ransomware attack forced manual accounting and blocked the lender reporting that would expose loan defaults, though a Russian-government distillery seizure was also a factor; ENGlobal (Chapter 11, Mar 2025) filed after ransomware plus a Nasdaq delisting. Note that Chapter 11 is reorganisation, not automatic death — but for an undercapitalised firm it often precedes liquidation. Most at risk: SMBs with no reserves, thin-margin trust-based B2B (debt collectors, data brokers, MSPs, logistics), already-distressed firms where cyber is the final shove, and regulated-data holders where fines and litigation dwarf the incident cost. The controls that would have prevented most of these are unglamorous: MFA and strong passwords, immutable/offline tested backups, segmentation, a rehearsed incident-response and comms plan, and realistic cyber insurance. Cyber risk is solvency risk, and belongs on the board and CFO risk register.
Can a hack put you out of business? Yes — but almost never the way people picture it. It is rarely the ransom that kills a company. It is the cascade: operations freeze, customers leave, the bills for cleanup and notification arrive, the lawsuits and regulators follow, and the lenders walk — all at once, usually on a business that was already thin-margin or stressed. Here are the companies that didn’t make it, and the pattern that killed them.
Defensive analysis for security leaders, CFOs and boards. Cited to public reporting and court filings; where cyber was one factor among several, we say so.
First, a definition that matters
Chapter 11 (US) is reorganisation — a filing is not automatically a death sentence; the company may restructure and survive. Chapter 7 / liquidation and UK/Australian administration are closer to “the company ends.” Several famous “cyber bankruptcies” are actually one of those. Keep the distinction in mind below.
The companies that didn’t survive
| Company | When / filing | Incident | What actually killed it |
|---|---|---|---|
| AMCA / Retrieval-Masters (medical debt collector) | Jun 2019, Chapter 11 → liquidation | 2018–19 breach, ~20M records via clients | All four biggest clients left (Quest, LabCorp, Conduent, CareCentrix). Trust was the product. Plus $3.8M+ in notification mailings. The textbook death spiral. |
| National Public Data / Jerico Pictures (data broker) | Oct 2, 2024, Chapter 11 | Late-2023 breach exposed Social Security numbers | ~20 class actions + FTC + 20+ states. Filing cited reputational damage, litigation and fines; listed near-zero assets. |
| KNP Logistics / Knights of Old (158-yr-old UK haulier) | Sep 2023, UK administration | Jun 2023 Akira ransomware; reportedly one weak password | Core systems encrypted, couldn’t raise rescue finance; ~730 jobs lost. A single credential ended a 158-year-old firm. |
| Stoli Group USA / Kentucky Owl | Nov 2024, Chapter 11 | Aug 2024 ransomware forced manual accounting | Couldn’t produce lender reports → triggered default reporting on ~$78–84M debt. But also a Russian-government distillery seizure — cyber was an accelerant, not the sole cause. |
| ENGlobal (Houston engineering) | Mar 2025, Chapter 11 | Ransomware + Nasdaq delisting | Business sold for ~$5.5M within ~100 days. Cyber on top of existing financial stress. |
Older canonical cases, for background: Travelex (2020, UK administration after ransomware), Code Spaces (2014, shut down within days after its cloud console was hijacked and its backups deleted), and Mt. Gox (2014, bankruptcy after a crypto theft).
The pattern: a six-stage death spiral
- Operational paralysis. Can’t invoice, ship, produce or dispense (KNP; Stoli’s accounting).
- Customer flight. In trust-based B2B the breach is the end of the relationship (AMCA lost all four anchor clients).
- Direct costs. Incident response, rebuild, ransom, and breach-notification mailings (AMCA’s $3.8M+ alone).
- Litigation + regulators. Class actions, FTC, state AGs, HIPAA/GDPR (NPD’s ~20 suits + FTC + 20 states).
- Financing collapse. Covenant breaches, inability to produce lender reports, investors walk (Stoli; KNP couldn’t raise rescue capital).
- Reputational destruction — which accelerates 2, 4 and 5.
Each is survivable alone. Stacked on a thin-margin or distressed business, they are not.
Who actually dies (vs. merely files and survives)
- SMBs — no cash reserves to absorb the cascade (KNP).
- Thin-margin, trust-based B2B — debt collectors, data brokers, MSPs, logistics: when the service is “we hold your data / move your goods safely,” one breach is terminal (AMCA, NPD).
- Already-distressed firms — cyber is the final shove, not the whole story (Stoli, ENGlobal).
- Heavily regulated data holders — fines and litigation can dwarf the incident cost (NPD, AMCA / HIPAA).
The leadership takeaways
- Cyber risk is solvency risk — it belongs on the board and CFO risk register next to liquidity and covenant risk, not buried in IT.
- The failures were preventable with basics: MFA and strong passwords (KNP), immutable/offline, tested backups (Code Spaces died because its backups were deletable), segmentation, a rehearsed IR + comms plan, and realistic cyber insurance.
- For trust-based B2B, model customer churn after a breach, not just incident cost — that’s the real killer (AMCA).
Find out where you stand
We built a free, browser-only Cyber Insolvency Risk Assessment that scores your exposure across exactly these five death-spiral dimensions and shows the gaps to close. And the War Room incident simulator drills the decisions a cyber crisis forces — isolate vs image, when to disclose, who to call — before you have to make them for real.
As of October 13, 2026. Based on public reporting and court filings; attributing a bankruptcy solely to a cyber incident is rarely clean, and several cases above had multiple causes. Educational analysis, not financial, legal or credit advice.
Ready to practise the decisions these articles describe?
Run a free War Room →