Attacks lasting between six to 24 hours for half of firms.
Distributed-denial-of-service (DDoS) attacks cost US businesses an average of $500,000, according to a survey from security firm Incapsula.
Half of those questioned said attacks lasted between six and 24 hours, during which time the flood of traffic used in DDoS attacks can cause slowdown and downtime, disrupting service for the user.
Writing in the report, Incapsula said: "Costs are not limited to the IT group, they also have a large impact on units such as security and risk management, customer service, and sales."
Of those surveyed, 87% experienced at least one non-financial consequence because of a DDoS attack, with half having to replace hardware or software and the same proportion having a virus installed on their network.
"Recovering from attack damage can also take months or years," Incapsula added. "An additional 43% confirmed that their organisation lost consumer trust [after the attack]. Each example reveals DDoS aftermath to be long-term."
The report noted that many of those surveyed were not adequately prepared to mitigate a DDoS attack, with more than half of respondents still relying on traditional firewalls or web app firewalls to protect themselves.
"In today’s world, where DDoS attacks are increasingly common and can easily cost an organisation hundreds of thousands of dollars, this is no longer tenable," the company said.