The Putin Tax and the Cost of Russian Hostility to Britain

On 1 October, the UK government announced its latest round of sanctions against Russia in response to the Kremlin’s full-scale invasion of Ukraine. Alongside providing financial and military support, issuing sanctions in response to Moscow’s illegal war of aggression has been central to the response of Ukraine’s allies since 2022 as they seek to restrict the funding and resourcing of the Russian military.

But Russia’s hostility is not restricted to its military action in Ukraine. Sabotage and cyberattacks also target European countries. While these attacks cannot be compared with those suffered on a daily, and hourly, basis by Ukrainians, they do inflict costs on the UK, costs that the government has yet to assess and articulate systematically.

An Unmeasured Burden

A parliamentary answer to Graeme Downie MP on 9 September illustrates the gap. Asked about Russia-originating cyberattacks and their economic cost, the government supplied incident statistics but no cost estimate. Its figures concerned hostile states collectively, leaving Russia’s share unresolved. While the government can describe the threat, it must also explain the economic consequences.

This gap matters and deserves attention. In an era where governments link economic and national security at every opportunity, protecting businesses from disruption and minimising the diversion of already stretched public resources into recovery and protection should be a priority. Understanding the cost inflicted by Kremlin hostility should inform how the government determines – and prioritises – its response.

Estimating the Putin Tax

A new report, The Putin Tax, makes a welcome attempt to fill this gap. Drawing on parliamentary questions, public reporting and industry evidence, it proposes a working estimate of an annual £2–2.5 billion burden. The analysis begins with identified costs from individual incidents including the Royal Mail cyberattack, the Leyton arson attack and the Jaguar Land Rover (JLR) cyber incident. Public reporting puts the combined costs of these incidents at approximately £1.6–2.1 billion, dominated by JLR.

The report also considers industry data identifying more than 300 Russia-linked cyber incidents since 2022, alongside government research on the average cost of significant cyberattacks and the wider annual burden of cybercrime. It separately examines potential losses from disruption to subsea infrastructure.

The analysis is necessarily approximate. These figures cover different periods, and Russia-linked criminal activity must be distinguished from operations directed by the Russian state. There is also an ambiguity of language of attacks that originate from Russia. An ambiguity that Vladimir Putin and those like him use to their advantage and which the UK has fed by the use of terms such as ‘sub-threshold’ activity.

Potential future losses are also distinct from damage already incurred. The annual estimate is therefore a starting point for further investigation. Government should build on this work with the resources and evidence available to it.

Costs Beyond the Immediate Target

The cases show why the burden extends beyond the immediate target. The Russian-ordered arson attack in Leyton in March 2024 caused approximately £1 million in physical damage, according to Counter Terrorism Policing. A fuller account would consider business interruption and the public resources required for investigation and response.

Figures were largely unavailable for drone-related airport disruption, but the research finds that the cost of the police investigation alone following the 2024 drone activity at RAF Lakenheath was in excess of £600,000.

JLR illustrates how cyber disruption can spread through an interconnected economy. The Cyber Monitoring Centre estimated the economic cost from the incident to the UK economy of £1.9 billion. Its scale demonstrates the importance of considering suppliers and customers alongside the directly affected company.

Why Measurement Matters

Assessing and quantifying this tax is important. With public finances under pressure, the government must constantly make spending decisions, and understanding this burden matters for the effective allocation of resources. Collecting evidence of the cost of Russian hostility will help the government justify its spending choices, strengthen the case for effective public and private sector resilience and identify where investment would make the greatest economic difference.

Spending on protection is visible, while the losses this investment prevents are harder to evidence. Better evidence would allow proposed investment to be weighed against the harm it could avert. It would also clarify who bears the costs: business losses and public expenditure both matter but have different implications for government.

Three Steps for Government

So, what should the government do?

First, to coin a phrase, ‘what gets measured, gets done’. Government needs a coordinated effort to quantify the Putin Tax, with a named department responsible and Treasury involvement in developing the methodology. The necessary data will be held across businesses, public bodies, insurance companies and infrastructure providers. Gathering it should capture recovery costs and wider disruption while protecting commercially sensitive information.

Second, the government should distinguish between measured losses, resilience spending and future exposure, and publish an annual assessment. This should explain attribution and uncertainty, avoid double counting and identify gaps in the evidence. Perfect information is unlikely; a transparent baseline that improves over time would already be valuable.

Third, this assessment must inform action. It should be accompanied by operational and investment commitments, identifying where stronger protection, faster recovery or disruption of hostile networks would reduce harm. Progress should be judged against those outcomes. Publishing a total is useful only if it changes decisions and helps explain them to the public.

The public also deserves a clearer explanation of this burden. Hostile activity can seem remote until its consequences emerge as interrupted services, lost business income or scarce public resources diverted into recovery. Explaining those effects would give substance to warnings about Russia and help make the case for preparedness, without suggesting that every economic loss represents money the Exchequer could otherwise spend.

‘Economic security is national security’ has become a familiar government refrain. Taking it seriously requires an understanding of how hostile activity damages the economy and what can be done to reduce that harm. Britain rightly devotes attention to imposing costs on Moscow – comparable attention should be applied to the costs Moscow imposes here. Understanding the price Britain is paying is essential to protecting its future.

© RUSI, 2026.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.