Ransomware takes a lender's systems down for three days. It normally collects Rs 40 crore a day, pays out Rs 35 crore a day and holds Rs 60 crore of cash. Compute the liquidity squeeze and set out the recovery and resilience measures that matter most.

Cash runs out during day 2, about 1.7 days in, and Talvenor needs about Rs 45 crore to get through three days. A business that normally makes Rs 5 crore a day loses Rs 35 crore a day once inflows stop and outflows do not. Deferring Rs 10 crore a day of vendor payments cuts the need to Rs 15 crore, and a Rs 50 crore committed line covers it. The measures that matter most are tested backups, a collection route that does not depend on its own systems, and a liquidity buffer sized to an outage.

Because it cuts one side of the cash flow and not the other. A shop whose card machine breaks still has to pay its staff and suppliers; its sales have stopped, its bills have not. Talvenor is normally Rs 5 crore a day better off, but with collections at zero it is Rs 35 crore a day worse off, so its Rs 60 crore lasts 1.7 days. By the end of day 3 it is Rs 45 crore short. An operational riskThe risk of loss from failed processes, people or systems, or from external events such as a cyber attack. event has turned into a liquidity event.

Rank the outflows and draw on backup liquidity before it is needed. Lender and bond payments come first, because a missed payment is a default that no restoration can undo; salaries second; dealer and vendor payments can wait a few days with a phone call. Deferring Rs 10 crore a day brings the need down to Rs 15 crore. Draw the committed credit line on day 1, not day 2: a lender that has just announced a cyber attack is the worst-placed borrower to negotiate new money. Tell the regulator and key lenders early, before they hear it elsewhere.

The ones that keep cash moving when systems do not. First, collections that run outside Talvenor's own systems, such as repayment mandates executed by its banks, so money keeps arriving even when its own software is down. Second, offline, tested backups with a recovery time for payment systems measured in hours, rehearsed, not assumed. Third, a liquidity buffer sized to an outage: five days of outflows, Rs 175 crore, or a committed line of that size. Fourth, a manual payment process for the critical outflows, with dual sign-off, because fraud attempts rise during an incident.

Then say what the numbers leave out. When systems return, three days of missed collections, about Rs 120 crore, do not all arrive at once; some borrowers will pay late and some will not pay the missed instalment at all. The squeeze can last a week or two after the systems are back, so the credit line should not be repaid the day the outage ends.