Cyber Insurance

International ransomware attack

The Policyholder (PH) reported that they discovered that their IT system had been infected with malware. They subsequently discovered that the malware was a new strain of ransomware that the PH’s antivirus detection system was unable to detect. The virus quickly infected and encrypted systems throughout the PH’s organisation, including their offices in the United States and the United Kingdom. All systems were locked, the PH closed all of its field offices and operations as their headquarters were significantly impacted.

The PH received a ransom demand of £10,000 in bitcoin to unlock the encryption. The ransom was paid but the encryption key was not released.

As a result, the PH was required to restore system operations from their backup files. Although the PH had backup files that were only a few days old, restoring full capacity system-wide took more than two weeks.

In addition, there was some indication of compromise of confidential information stored within the PH’s system. It became necessary to conduct a forensic investigation to determine the extent of the intrusion. There were ultimately no third-party claims. The total insured loss was more than £70,000. The major expense items were: a breach coach, a forensic consultant, business interruption and other expenses.

Municipal ransomware attack

This Policyholder (PH) discovered this incident when she attempted to access data and was unable to open an application. Ultimately, all of the PH’s software applications were impacted and locked out, including all Microsoft Windows applications and all mainframe applications. The PH then received a ransom demand. At the time of the demand, all of the PH’s system applications were locked out, including emergency services and local authority systems.

A forensic investigation confirmed that the malware placed on the PH’s systems was designed only to encrypt – there was no exfiltration of data and no access to or acquisition of personally identifiable information. The PH received an email from the cyber-criminals containing a ransom demand, and subsequent follow up confirmed that the cyber-criminals were located outside of the UK.

The cyber-criminals demanded a ransom of £5,000 to £8,000 payable in bitcoin. The ransom was ultimately negotiated and paid through use of a breach coach, and the decryption key was released, allowing the PH to restore full system functionality.

The total insured loss was more than £25,000. The major expense items were: a breach coach, a forensic consultant, payment of the ransom and expenses related to restoring the PH's system.

Phishing attack

This matter arose from a phishing attack that occurred when cyber-criminals posing as Microsoft employees tricked a Policyholder’s (PH) employee into granting remote access to its system. Once access was granted, the cyber-criminals accessed more than 12,000 individual patient records dating back to 1994. The PH’s IT department and a forensic investigator confirmed that the personally identifiable information of current and former clients had been stolen, including driver’s licence numbers, dates of birth and national insurance numbers.

A breach coach was retained and coordinated notice and communication with the ICO and other relevant authorities. In addition, the breach coach coordinated notice to the impacted individuals. The notice required a press release, individual written notice, staffing of a call centre and credit monitoring for clients who elected the coverage. There were no third-party claims made before or after notice to the current and former clients.

The total insured loss was more than £50,000. The major expense items were: a breach coach, a forensic consultant, public relations expenses, notice and call centre expenses, and the cost of credit monitoring for clients who requested the service.