Key lessons from cyber incidents

Retailing/wholesaling

Background

The Insured automotive company that offers vehicle sales and parts. After processing a payment through their bank, the Insured received a call from Threat Actors purporting to be their bank. Threat Actors were able to confirm the details of the recent transaction and then flagged a suspicious transaction made after the approved transaction, which didn’t exist. Threat Actors obtained the security token from the Insured over the phone as a purported verification step and were able to process fraudulent transactions totalling over $250,000.

Outcome

The Insured sought cover under the policy for the loss of funds and expenses to investigate the incident. Forensic investigation identified an email account was breached along with the Insured’s bank account, there was no MFA on these accounts. Threat Actors were able to monitor transactions and able to process their own after obtaining the security token. The bank managed to recover around $90,000 and the sub-limit for cyber fraud was $100,000, Digital Forensics were $60,000 and legal fees were $35,000.

Transport and logistics

Background

The Insured received a payment request from an overseas supplier and the Insured proceeded to email the supplier to confirm the account details. The supplier flagged that their bank account was being audited and funds needed to go to a different account, sending a new payment request. Payment was processed the updated account details that had been supplied by Threat Actors and funds were paid to the fraudulent account. After 3 weeks the supplier followed up on the outstanding payment and it was identified that the fraud had occurred.

Outcome

The Insured’s bank was unable to recover any of the funds and the overseas supplier confirmed that their email account had been compromised. Insurers indemnified the losses of the Insured totalling $85,000. No forensic or legal work was required as the breach was no on the Insured’s systems.

Medical services

Background

The Insured was hit with a Ransomware attack which impacted one of their servers, including their onsite backups. Fortunately, there was no breach of the client or guest systems which contained the medical data. The Insured also had off-site back up services which had a viable back up from 12 hours before the compromise.

Outcome

The Insured continued to use their IT service provider along with a couple of vendors from our panel to assist with the legal investigation and further digital forensic work. This included liaising with clients, customers and government bodies. A data review was required along with substantial remediation work on the systems. Total legal fees incurred were $125,000 and IT and forensic work was $100,000.