The systems came back. The season didn't.

Picture a merchandising lead in late spring, standing in a warehouse of summer stock that was bought months ago. The systems are back. The website takes orders again. The invoices from the incident advisers have been paid. But the selling season the stock was bought for is half over, and the stock is still on the shelves. The warehouse and the lead are invented for this dispatch. The arithmetic they face is not.

Last Wednesday, May 20, two companies reported results that put numbers on cyber incidents well after the attacks themselves. Marks & Spencer published its first full year that includes the incident that disrupted its business in the first half. It booked £131.3m of incident-related costs within its adjusting items and £100.0m of insurance proceeds in respect of the incident, and described the year as one of two halves: significant operational impact in the first, a return to sales and profit growth in the second.¹ Hasbro, which identified unauthorized access to its network in late March, said it was still restoring its systems, and that the full scope of the costs had not been determined.⁴

My argument is that an incident's cost arrives on two ledgers. The remediation bill is the one that gets reported as the cost: advisers, legal work, rebuilding, recovery. The business calendar is where much of the rest lands: the season the stock was bought for, the quarter the orders were meant to ship in, the invoices that could not go out. The calendar does not wait for the restore. Leaders should size an incident in the units the business runs on, and decide before an incident which of those units comes back first.

Three lines of cost

The two reports show three different kinds of cost, and only one of them looks like an IT bill.

The first is remediation. On Hasbro's earnings call, its chief financial officer, Gina Goetter, said the company expected about $20 million of additional operating expenses associated with remediation.⁵ That is a management expectation, not a result, and it is the line most people mean when they ask what an incident cost.

The second is timing. Goetter also said Hasbro expected about $40 million to $60 million of Consumer Products revenue to be delayed from the second quarter to the back half of the year, most of it into the third quarter. Cash would be lumpy too. “Our invoicing was shut off for a while,” she said.⁵ In April, the company had said that it was still taking orders and shipping product under its business continuity plans, but expected delays in order processing, shipping and invoicing.³ Revenue that moves a quarter is not lost, but the gap between delivering and getting paid is a cost of its own, as I argued about growth on May 17: profit and cash keep different calendars.

The third is position: goods that miss the window they were bought for. M&S's Fashion, Home & Beauty sales fell 7.7 percent, which the company attributed to the temporary pause in online trading and systems access, disrupting stock flow and restricting availability. Adjusted operating profit in that business fell from £478.0m to £213.4m, “reflecting the markdown and clearance of excess seasonal stock related to the incident,” principally in the second half.¹ The systems were back in that half. The stock had been bought for a season that had already passed. In Food, M&S cited increased markdown and waste in the first half.¹ Investing.com, describing the incident as a “seven-week suspension of online clothing orders,” reported that the Fashion, Home & Beauty gross margin fell 270 basis points over the year.²

The insurer keeps a calendar too

Insurance offsets part of the remediation bill, on its own timetable. M&S recorded its £100.0m of proceeds centrally in adjusted profit.¹ Hasbro said it was documenting claims with its cybersecurity insurers, that the receipt, timing and amount of any reimbursement were not yet known, and that recoveries “may differ from the timing of recognizing the associated expenses.”⁴ A recovery can land in a later period than the cost it covers, and it covers the policy's terms, not the season.

Restore order is a business decision

Hasbro's statements show a choice. In April it said systems taken offline for containment were being “brought online sequentially,” and that this had delayed its quarterly report and filing.³ On the May 20 call, Goetter said the company had prioritized getting its financial systems stood up so it could report and file, and was now turning back on the systems for order management, shipping and invoicing, on track for a June timeline.⁵

That is a defensible order. A listed company has hard reporting deadlines. It is also an order, and every order decides which business cycle waits. Whether the systems can be recovered at all is a separate question, one I took up on Sunday in The backup has to come back. This one starts after recovery works. Figure 2 shows how the same four restores, in two different orders, put different cycles at risk.

Few companies write that order down before they need it. Under pressure, the order tends to follow whoever is in the room. The better time to choose it is a quiet quarter, in business terms: which cycle can slip a week, which cannot, and which one you accept missing.

This is not a claim that either company's figures isolate every effect of its incident, and it is not investment advice. M&S ties the clothing markdowns to the incident in its own words, but its segment results cover a full year of other trading too. Hasbro's restoration was still in progress, and its figures are expectations. The view from Morgan Stanley's Izabel Dobreva, reported by Investing.com, that around three quarters of the hit will unwind in M&S's next financial year is a forecast.² And two companies are not a sample. The pattern is still worth noticing: in both cases, the costs that grew after recovery were measured in stock, quarters and invoices.

An incident is over for the systems before it is over for the business.

Before the next incident

• Which business cycle does each critical system feed? Name the season, month-end, payroll or billing run, and the date it cannot move.
• What is the restore order, in business terms? Agree it in advance, including the cycle you accept missing.
• What does your cyber cover reimburse, and when? Know how recognition and cash can lag the cost.
• Does the plan budget for the after-effects? Markdowns, catch-up shipping and cash gaps belong beside the response fees.

Back to the warehouse. The systems are back, and the advisers' invoices are closed. The merchandising lead's problem was never on those invoices. It was on the season calendar, and the next plan should put that calendar beside the restore list, with a date against each line.