Cyber crises: the psychological impacts of cyberattacks

Since the emergence of a mass cybercriminal threat, the risk of cyberattack has become a risk to be understood by organisations of all sizes, whether it is a local authority, a large group or an SME. While the operational and financial consequences of these crises often make the headlines, their human and psychological effects remain too little explored. Yet, behind the corrupted lines of code and paralyzed servers, it is women and men who are bearing the brunt of these digital intrusions.

The initial shock: the abrupt break from everyday life and paralysis

From the very first moments, it is possible that the attack will plunge employees into a state of shock. The computer tool, which has become the basis of daily work, is suddenly interrupted. No more messaging, telephony, access to business applications: the work routine is broken. The suddenness and brutality of the rupture generate this stupefaction and as a corollary the paralysis of the entire organization.

In addition to this material loss, there is a loss of bearings. Many discover that they have no mental preparation or specific training to react to such an event. This lack of preparation generates immediate anxiety, because no trajectory has been defined for the resolution of the crisis and the actions to be taken to respond to the challenges that arise.

The feeling of powerlessness in the face of a perception of an unacceptable failure

For frontline employees – whether they are citizen-facing agents, customer advisors or operational teams – the cyberattack creates a painful contradiction: the obligation to provide service remains intact, but it becomes materially impossible to fulfill. This dissonance feeds stress, the feeling of failure and sometimes guilt.

In some organizations, the lack of understanding of users or customers further amplifies the tension: perception of a lack of clear communication, restoration times considered uncertain, and expectations not met. The aggressiveness of some interlocutors thus falls directly on the teams, further weakening their psychological state.

A crisis that is a long-term one… and in people’s minds

Cyber crises are known to be long. Very long. On the technical aspects, investigations, remediation operations and tests can take several weeks or even months. As for the legal aspect, it is also a long-term one. This long time frame wears out the teams: they juggle with makeshift solutions, entrenched transitional procedures and permanent uncertainty.

This climate maintains increased psychological fatigue, especially for those in charge of crisis management or communication. Repeating anxiety-provoking messages, managing disappointed expectations, coping with the lack of recognition: all factors that can lead to both physical and psychological exhaustion.

The return to normality: an illusion?

Once the systems are restored, the organization speaks of a “return to normal”. But for employees, nothing is the same as before. The experience leaves lasting traces: latent anxiety, loss of confidence in digital tools, mistrust of internal procedures, or even a feeling of abandonment if managerial support has been insufficient.

IT teams, on the front line during the occurrence of a cyberattack, are particularly affected by longer-term effects: increased pressure during the management of the incident, which can last several weeks or even months, and in the post-incident, questioning of practices and know-how prior to the incident. It is not uncommon to observe impacts such as burn-outs or higher turnover in teams that have had to manage major incidents in the months following the occurrence of the incident.

The psychological pressure imposed by the attackers

Beyond the technical aspects, attackers today are exploiting direct pressure strategies aimed at psychologically destabilizing victims and their teams:

Publication on “walls of shame” where stolen data is exposed, posing a public threat to the organization’s reputation.
Ultimatums with countdowns, reinforcing fear and artificial urgency.
Combined pressures, such as coupling ransomware with DDoS attacks to cripple all communication.
Double or even triple extortion, where cybercriminals not only threaten the organization and its customers, but also address partners or the media, thus increasing the circle of pressure and stigma.

These tactics increase the emotional burden on crisis and incident response teams, who have to deal not only with technical restoration and communication, but also with the psychological intimidation intentionally maintained by these malicious actors.

When media exposure fuels psychological pressure

Media pressure is an aggravating factor that is often underestimated during a cyber incident. Specialized journalists and dark web watchdogs quickly publish technical investigations, leaked data extracts or vulnerability analyses — practices that can amplify the visibility and perceived urgency of the crisis. At the same time, independent “cyber influencers” report and comment on elements from the dark web, which can force a company to respond publicly to sometimes incomplete allegations. The journalistic profession has an ethical obligation to seek the adversarial process and to solicit the victim before publication, but this solicitation can be experienced as intense pressure by organizations that are not used to managing the press in a crisis situation. These dynamics — active vulnerability mining, exploitation of data extracts, repeated solicitations and media coverage by highly followed accounts — contribute to what some describe as unwitting relays of the narratives of criminal groups, and can weigh on the cognitive and emotional load of teams.

Trauma-like effects

The brutal and unexpected nature of a cyberattack, often revealing a lack of preparation or lack of preparation, underlines the vulnerability of an organization. This perception of a new fragility clashes with previous representations of the health and sustainability of the organization, which can be accompanied by trauma. At the end of the crisis, the difficulty of returning to a normal situation and the various impacts of the disaster fuel traumatic effects for the members of the organization. The mental apprehension of how to deal with a cyberattack is often compared to the phases of mourning: denial, anger, bargaining, acceptance and reconstruction. The work of preparation and anticipation facilitates the rapid transition to the reconstruction phase and limits the negative effects.

Scientific research confirms that cyberattacks can provoke reactions similar to those observed during “classic” traumatic events. Acute stress, depressive symptoms, anxiety disorders… The immaterial nature of aggression does not reduce its impact, it sometimes makes it more difficult to identify, because it is less tangible and more diffuse.

Towards organizational resilience that integrates the human factor

Faced with these findings, organizations can no longer limit their resilience strategy to technical aspects alone. The human factor must be integrated at every stage:

Upstream, through awareness, training and crisis exercises to prepare the teams mentally and emotionally.
During the crisis, through clear, transparent and caring support, which reassures employees and gives them a sense of control.
After the crisis, through psychological follow-up for employees by expressing the need, collective and individual, as well as through formalized feedback by focusing on at-risk populations: IT teams and teams in charge of customer relations and the person behind the cyberattack in the event of human error.

Practical Recommendations for Organizations

1- Prepare the teams in advance

Awareness-raising sessions integrating the psychological dimension and not only the technical dimension.
Crisis exercises that include all levels of the organization, not just IT.
Accessible “crisis kit”: instructions, internal contacts, psychological resources.

2- Support during the crisis

Regular and clear internal communication unit with a particular focus on internal communication.
Psychological or HR relays identified and available.
- For example: call on structures (allowing psychological support in crisis) led by occupational and psychosocial risk psychologists.
Monitoring of the workload of the mobilized teams to avoid exhaustion.
Specific support for incident response teams, particularly targeted by pressure from attackers.

3- Supporting after the crisis

Collective and individual debriefings to verbalize and share the experience.
Provision of psychological listening devices and/or occupational psychologists and organizations directly on site.
Formal recognition of team commitment and integration of learnings into future plans.

Conclusion

Experience shows that cyberattacks have a psychological dimension in their own right. Whether disruptive or discreet, direct or manipulative, they can weaken employees. Acknowledging and addressing this dimension means giving the organization a real chance to remain resilient.

Article written by:

Nathan VITAL – PhD student in cognitive psychology – in CIFRE at Alcyconie
Stéphanie LEDOUX – CEO Alcyconie