Imagine you’re a CEO. It’s an ordinary day in the office of your boutique investment firm: you’re sending emails, reviewing documents, crossing items off your to-do list.

Then you notice something that makes you pause. An email in your sent mailbox – no wait; multiple emails – that you most definitely did not send, or even draft. Looking at your mailbox, you can see thousands of your private contacts have been sent emails from your account. Something has gone very wrong.

You grab the phone and dial your insurance broker – fast.

This is a real scenario, but luckily, the firm had cyber cover

Thankfully, the firm in question had a cyber insurance policy though Coalition* – one of Allianz’s partners and a leading provider of what’s known as Active Cyber Insurance.

Active Insurance combines assessment, protection, response, and coverage – all as part of the same policy. As Trent Nihill, Head of Underwriting in Coalition’s Australian business, explains, “good cyber insurance isn’t just a policy, it’s a service. It’s not like a traditional insurance policy that just indemnifies a client; it provides a whole suite of practical services.”

In this case, it meant Coalition was able to move fast to implement additional security measures immediately.

Once the CEO called the broker, and the broker notified Coalition, it took just minutes for Coalition to help the CEO change relevant passwords to mitigate the impact of the breach. Immediately, Coalition helped the business and broker select expert claims counsel and a digital forensics incident response (DFIR) firm to investigate exactly what had happened, and address any legal, accounting, and PR requirements that might arise.

Piecing together the cyber-attack – and picking up the pieces

The DFIR firm in this instance determined that the CEO’s email account had been compromised through a phishing attack. A fraudulent DocuSign document redirected the CEO to a fake login page, which asked for login credentials and allowed for continued access to the inbox. After this, the threat actor sent additional phishing attempts to over 1000 of the CEO’s contacts.

This mode of attack is a common strategy used by threat actors, explains Sam Weaver, General Manager of Coalition’s Australian business. “We see that most cyber risk events have a human error element – like a person clicks the wrong link in an email. We’d call that a social engineering event.”

In the case of the boutique investment firm, the impersonation-based phishing attack also allowed the threat actor to access documents, spreadsheets and attachments contained within the CEO’s inbox. This required the firm to determine if additional notifications were required for clients whose personal information was accessed.

The takeaway? Always exercise caution before clicking links – and also ensure you have cyber insurance. Sam reiterates, “Our US team found that more than half of all cyber claims in 2023 originated in the inbox.”

It all ended happily – thanks to a robust cyber insurance policy

For the CEO, this scenario resolved without permanent damage. Because the firm’s policy included Breach Response, the approximately AUD$50,000 cost of breach counsel, DFIR and notifications was covered (once the firm met its AUD$2500 self-insured retention). The DFIR firm also presented a final forensic report with recommendations to strengthen the investment firm’s defences against future cyber attacks.

The CEO of the investment firm commented on the speed with which Coalition and service partners moved – describing the claims team as “absolute weapons” – as this speed helped limit the impact of the attack and minimise flow-on effects.

So, what’s the bottom-line? Help your clients protect theirs. Learn what you need to know about cyber insurance as a broker, and how to talk to your clients about it. You can also find more details at the Coalition website – or speak to your Allianz Representative.

* Insurance cover is issued by Coalition Insurance Solutions Pty Ltd (“CIS AU”) (ABN 33 657 140 791, AFSL 539846) under a binding authority given by Allianz Australia Insurance Limited (ABN 15 000 122 850, AFSL 234708) (Insurer). This information is of a general nature only and does not take into account any person's particular circumstances. All descriptions of coverage are subject to the terms, conditions, and exclusions of the individual policy. Before making a decision (or advising your client), please refer to the relevant policy wording available on the Coalition website or by contacting your broker. CIS AU may receive compensation from an insurer or other intermediary in connection with the sale of insurance cover. See Disclaimers. Copyright © 2024. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc.

This article has been prepared by Allianz Australia Insurance Limited ABN 15 000 122 850 AFSL 234708 (“Allianz”). Information contained in this article is accurate as at 31 October 2024 and may be subject to change. In some cases, information has been provided to us by third parties and while that information is believed to be accurate and reliable, its accuracy is not guaranteed in any way. Any opinions expressed constitute our views at the time of issue and are subject to change. Neither Allianz, nor its employees or directors give any warranty of accuracy or accept responsibility for any loss or liability incurred by you in respect of any error, omission or misrepresentation in this article.