From paying the ransom to access your files or finding out you've experienced fraudulent wire transfers.
Fines & Penalties:
Federal, State, and PCI can all impose fines and penalties on an organization when a security incident occurs.
Financial damage is bad, but reputational damage is devastating. Gaining back lost trust is a hard pill to swallow.