We developed a Monte Carlo cyber-risk quantification model that translates ransomware disruption of urban water treatment and distribution systems into service, cash-flow, and tail-loss outcomes. Unlike attack-detection studies, the analysis began after compromise and examined how attack locus, outage duration, treatment or pumping capacity loss, water-storage buffer, infrastructure redundancy, network segmentation, backup maturity, manual operating capability, privileged-access maturity, and incident-response readiness interact. The synthetic experiment comprised 15,000 scenarios across six attack loci: enterprise information technology, SCADA/HMI, historian and telemetry, pump stations, treatment controls, and enterprise-wide compromise. Direct operator loss combined incident response, emergency water supply, overtime, energy inefficiency, revenue loss, public communication, regulatory response, asset restoration, and data restoration. A separate societal layer represented business interruption and expected public-health consequence. Mean direct operator loss was $1.49 million, median loss was $1.09 million, 95% value at risk was $3.81 million, and 95% conditional value at risk was $5.71 million. Enterprise-wide scenarios produced the largest median and tail losses. Attack duration explained most modeled loss variance, followed by capacity loss, daily demand, backup maturity, and population served. An integrated resilience portfolio combining segmentation, offline backup, manual continuity, incident-response capability, and privileged-access improvement reduced mean modeled loss by 40.6% and CVaR95 by approximately 40%. The study provides a transparent framework for engineering, cybersecurity, finance, and executive teams to compare mitigation investments using service continuity and loss distributions rather than qualitative risk ratings alone.