Per Outage Duration
Multi-day outage cost: 2 to 7 day DR scenarios, priced.
Multi-day outages are rare. Per Uptime Institute Annual Outage Analysis 2025, fewer than 0.5% of significant outages last more than 48 hours in their full-impact form. They are also the scenario that justifies the most expensive resilience investments, because by day three a single-site failure has typically blown through every recovery time objective in the plan. A 7-day outage costs a mid-size enterprise roughly $50 million linearly, and large enterprises into nine figures.
Headline Math
Cost by duration and segment
These are linear extrapolations from ITIC 2024 per-hour figures. Real multi-day outages deviate from linear in two ways. They tend to run lower than linear in absolute dollar revenue (off-business-hours discount), but higher than linear in reputation and churn (compounding tail), so the totals net out close to linear. We present the linear figure because it is the most defensible single number for a board document.
| Duration | Mid-size ($300K/hr) | Large enterprise ($2M/hr blend) | Finance peak ($9.3M/hr) |
|---|---|---|---|
| 2 days (48 hours) | $14,000,000 | $48,000,000 | $446,000,000 |
| 3 days (72 hours) | $21,000,000 | $72,000,000 | $669,000,000 |
| 5 days (120 hours) | $35,000,000 | $120,000,000 | $1,116,000,000 |
| 7 days (168 hours) | $50,000,000 | $168,000,000 | $1,562,000,000 |
| 10 days (240 hours) | $72,000,000 | $240,000,000 | $2,232,000,000 |
Sources: ITIC 2024 per-hour figures, linear projection. Figures USD, as of 2026-05-18.
Historical Reference Events
Every named multi-day outage of the last 15 years
| Event | Year | Duration | Disclosed cost | Notes |
|---|---|---|---|---|
| PSN outage (Sony) | 2011 | 23 days | $171M disclosed | Cyberattack, full restore took 3+ weeks |
| TSB Bank IT migration | 2018 | Multi-week tail | £330M Lloyds writedown | Migration to Sabis platform, FCA £48.65M fine 2022 |
| Maersk NotPetya | 2017 | 10 days global outage | $200-300M Maersk disclosure | Cyber-caused, full recovery 2 weeks |
| Norsk Hydro | 2019 | Several weeks reduced operations | NOK 800M ($75M) | LockerGoga ransomware |
| Colonial Pipeline | 2021 | 6 days pipeline shutdown | $4.4M ransom + lost revenue | DarkSide ransomware |
| CrowdStrike | 2024 | Multi-day customer recovery | $5.4B Fortune 500 (Parametrix) | Defective Falcon sensor update |
Note the cyber-causation pattern. Five of the six major multi-day outages above were caused by cyber attacks or compromised supply-chain updates, not infrastructure failure. The base rate for multi-day outages from non-cyber root causes is meaningfully lower than the headline frequency implies. See DataBreachCost.com for the breach-specific economics.
PSN April 2011, In Detail
The 23-day outage that defined multi-day economics
Sony PlayStation Network went down on 20 April 2011 following an external intrusion. The network was fully restored by 14 May 2011, with personal data of approximately 77 million accounts compromised. Sony disclosed an aggregate cost of $171 million in its fiscal Q1 reporting, of which approximately $14 million was direct customer compensation (the "Welcome Back" programme) and the balance was incident response, regulatory response, infrastructure remediation, and lost revenue.
What makes the PSN case useful is how the cost shape diverged from the per-hour benchmark. Sony's direct revenue loss for 23 days of PSN downtime was a fraction of the $171M total, because PlayStation hardware sales continued, single-player gameplay continued, and the bulk of the affected revenue was deferrable rather than lost. Most of the cost was forensics, security upgrade, regulatory follow-through across multiple jurisdictions, the customer-compensation programme, and brand-rebuilding marketing spend in the subsequent quarter. For multi-day outages with a cyber root cause, this is the modal cost-shape: a small lost-revenue line and a very large non-revenue line.
By contrast, an airline or hospital multi-day outage looks different. Direct revenue loss and contingent compensation (EU261, patient transfers) dominate. The reputation tail is real but accounts for a smaller fraction. For DR planning, the cost-shape question is "is your revenue deferrable or lost?" A PSN-style outage defers most revenue. An airline-style outage loses it irrecoverably.
The DR Investment Case
When does multi-day DR pay for itself?
For a mid-size enterprise, the relevant DR investment is some form of active-active multi-region deployment with sub-hour RTO and near-zero RPO. The annual cost of this investment runs $300,000 to $800,000 depending on data volume, traffic pattern, and how much of the redundant capacity is hot versus warm. The expected-loss math works as follows.
Expected-loss calculation
- Baseline probability of a 48+ hour outage in any given year: 1 to 2% for a single-region cloud deployment with decent operational practice
- Cost if it happens: $14M (the 48-hour mid-size figure)
- Expected annual loss: $140,000 to $280,000
- Cost of multi-region active-active: $400,000 to $600,000 annual
- Probability reduction: from 1.5% to under 0.2%
- Post-investment expected annual loss: $28,000 or less
- Net expected annual benefit (loss reduction minus investment cost): -$300,000
- This is the standard case in which the math does not favour multi-region active-active for a typical mid-size enterprise on direct expected-value grounds alone
The investment case typically rests on two non-expected-value factors. First, the option value of avoiding a single catastrophic event that would meaningfully harm the business. Second, regulatory or contractual requirements (financial services, government work, large enterprise customers' security questionnaires) that mandate the investment regardless of pure expected-value math. For the option-value framing, the right number to compare against is not the expected annual loss but the worst plausible single-event loss, which for a 7-day mid-size outage is $50M. Against $50M of catastrophic risk, a $500K annual hedge is straightforward.
Cost Shape Past Day Two
What is actually expensive after 48 hours
Customer-acquisition replacement
Past 48 hours, you have to win back customers you lost. CAC for a B2C subscription typically runs $30 to $200; for B2B SaaS $1,000 to $10,000. Replacing 5% of a 1M-customer base at $50 CAC is $2.5M in incremental marketing spend over the recovery quarter.
Executive bandwidth
CEO, CTO, CFO, CISO, GC, and SVP Comms each absorbed by the incident for the duration. Public-company calls, board updates, regulatory disclosure preparation, customer-letter authorisation. The opportunity cost of executive time during a multi-day incident runs into the millions in lost decision-making on other matters.
Litigation reserves
Multi-day outages routinely trigger class-action suits. The reserve charge in the next quarter's P&L is a real number even before any settlement. Delta's 2024 CrowdStrike-caused outage produced a $500M lawsuit against CrowdStrike, with reserves on both sides.
Regulatory remediation
Bank regulators (OCC, FCA), telecom regulators (FCC, Ofcom), and healthcare regulators (HHS) all impose remediation programmes after major outages. The remediation cost (audit, third-party assessment, mandated process changes) routinely exceeds the headline fine.
Frequently Asked
Common Questions
How much does a 48-hour outage cost?
How often do 48-plus-hour outages happen?
Should I size DR for the multi-day case?
What was the cost of the PSN outage in 2011?
How long was the longest-ever IT outage?
Are most multi-day outages cyber-caused?
What does a multi-day outage do to share price?
Related