UK Report Puts a Price on Russian Cyber Threats: At Least $2.6 Billion a Year, and No Official Count

A report titled The Putin Tax, written by Labour MP Graeme Downie and researcher Dominic Reed, argues that the British government is failing to measure what Russian cyberattacks, sabotage and threats to critical infrastructure cost the country. The authors estimate the burden at between £2 billion and £2.5 billion ($2.6 billion to $3.3 billion) a year, and describe that figure as a floor. They acknowledge their methodology was limited, but stress that the main point is the lack of an official alternative.

Downie put parliamentary questions to several government departments and found that ministers held no estimates of the economic impact of Kremlin-linked incidents. The report says no analysis was done of the costs of two ransomware attacks, one on NHS software supplier Advanced and one on Royal Mail, carried out by a group alleged to operate with the Kremlin's tacit consent. The largest part of the headline figure assumes Russia is responsible for 10% of the £14.7 billion ($19.3 billion) the government says cybercrime costs British businesses each year, though that percentage is not based on precise attribution. The remaining figures come from models, not public data.

The report also references the August 2025 cyberattack on Jaguar Land Rover, estimated to have cost the British economy $2.5 billion, although the UK government has not formally attributed it to Russia-linked actors. Its authors argue that if the public cannot see what hostile activity costs, it cannot weigh that burden against the cost of defending against it.