# Can a Cyberattack Bankrupt You? The Companies That Didn’t Survive

> A cyberattack rarely bankrupts a company via the ransom itself — it is the cascade: operations freeze, customers flee, remediation and notification costs pile up, lawsuits and regulators arrive, and lenders pull out, all at once. Here is a cited analysis of real companies that filed Chapter 11 or collapsed after a breach — AMCA, National Public Data, KNP Logistics, Stoli, ENGlobal — the pattern that killed them, who is most at risk, and what actually prevents it.

Source: https://playciso.com/blog/cyberattack-bankruptcy-companies-that-did-not-survive-2026 · Published: 2026-10-13 · Publisher: PlayCISO (https://playciso.com)

---

Can a hack put you out of business? Yes — but almost never the way people picture it. It is rarely the ransom that kills a company. It is the **cascade**: operations freeze, customers leave, the bills for cleanup and notification arrive, the lawsuits and regulators follow, and the lenders walk — all at once, usually on a business that was already thin-margin or stressed. Here are the companies that didn’t make it, and the pattern that killed them. _Defensive analysis for security leaders, CFOs and boards. Cited to public reporting and court filings; where cyber was one factor among several, we say so._ ## First, a definition that matters **Chapter 11** (US) is _reorganisation_ — a filing is not automatically a death sentence; the company may restructure and survive. **Chapter 7** / liquidation and **UK/Australian administration** are closer to “the company ends.” Several famous “cyber bankruptcies” are actually one of those. Keep the distinction in mind below. ## The companies that didn’t survive CompanyWhen / filingIncidentWhat actually killed it **AMCA / Retrieval-Masters** (medical debt collector)Jun 2019, Chapter 11 → liquidation2018–19 breach, ~20M records via clients[All four biggest clients left](https://cyberscoop.com/amca-bankruptcy-data-breach-quest-diagnostics-labcorp/) (Quest, LabCorp, Conduent, CareCentrix). Trust was the product. Plus $3.8M+ in notification mailings. The textbook death spiral. **National Public Data** / Jerico Pictures (data broker)Oct 2, 2024, Chapter 11Late-2023 breach exposed Social Security numbers[~20 class actions + FTC + 20+ states](https://therecord.media/national-public-data-bankruptcy-cyberattack). Filing cited reputational damage, litigation and fines; listed near-zero assets. **KNP Logistics** / Knights of Old (158-yr-old UK haulier)Sep 2023, UK administrationJun 2023 Akira ransomware; reportedly one weak password[Core systems encrypted, couldn’t raise rescue finance; ~730 jobs lost](https://motortransport.co.uk/blog/2023/09/25/cyber-attack-pushes-knp-logistics-into-administration-with-loss-of-730-jobs/). A single credential ended a 158-year-old firm. **Stoli Group USA** / Kentucky OwlNov 2024, Chapter 11Aug 2024 ransomware forced manual accounting[Couldn’t produce lender reports → triggered default reporting](https://www.scworld.com/news/stoli-group-usa-files-for-bankruptcy-after-ransomware-attack) on ~$78–84M debt. _But also_ a Russian-government distillery seizure — cyber was an accelerant, not the sole cause. **ENGlobal** (Houston engineering)Mar 2025, Chapter 11Ransomware + Nasdaq delisting[Business sold for ~$5.5M within ~100 days](https://elevenflo.com/blog/englobal-bankruptcy). Cyber on top of existing financial stress. Older canonical cases, for background: **Travelex** (2020, UK administration after ransomware), **Code Spaces** (2014, shut down within days after its cloud console was hijacked and its backups deleted), and **Mt. Gox** (2014, bankruptcy after a crypto theft). ## The pattern: a six-stage death spiral - Operational paralysis. Can’t invoice, ship, produce or dispense (KNP; Stoli’s accounting). - Customer flight. In trust-based B2B the breach is the end of the relationship (AMCA lost all four anchor clients). - Direct costs. Incident response, rebuild, ransom, and breach-notification mailings (AMCA’s $3.8M+ alone). - Litigation + regulators. Class actions, FTC, state AGs, HIPAA/GDPR (NPD’s ~20 suits + FTC + 20 states). - Financing collapse. Covenant breaches, inability to produce lender reports, investors walk (Stoli; KNP couldn’t raise rescue capital). - Reputational destruction — which accelerates 2, 4 and 5. Each is survivable alone. Stacked on a thin-margin or distressed business, they are not. ## Who actually dies (vs. merely files and survives) - SMBs — no cash reserves to absorb the cascade (KNP). - Thin-margin, trust-based B2B — debt collectors, data brokers, MSPs, logistics: when the service is “we hold your data / move your goods safely,” one breach is terminal (AMCA, NPD). - Already-distressed firms — cyber is the final shove, not the whole story (Stoli, ENGlobal). - Heavily regulated data holders — fines and litigation can dwarf the incident cost (NPD, AMCA / HIPAA). ## The leadership takeaways - Cyber risk is solvency risk — it belongs on the board and CFO risk register next to liquidity and covenant risk, not buried in IT. - The failures were preventable with basics: MFA and strong passwords (KNP), immutable/offline, tested backups (Code Spaces died because its backups were deletable), segmentation, a rehearsed IR + comms plan, and realistic cyber insurance. - For trust-based B2B, model customer churn after a breach, not just incident cost — that’s the real killer (AMCA). ## Find out where you stand We built a free, browser-only [Cyber Insolvency Risk Assessment](/tools/cyber-insolvency-risk) that scores your exposure across exactly these five death-spiral dimensions and shows the gaps to close. And the [War Room incident simulator](/warroom) drills the decisions a cyber crisis forces — isolate vs image, when to disclose, who to call — before you have to make them for real. _As of October 13, 2026. Based on public reporting and court filings; attributing a bankruptcy solely to a cyber incident is rarely clean, and several cases above had multiple causes. Educational analysis, not financial, legal or credit advice._