Cyber Insurance

While underwriting for a policy for a new healthcare client, AIG identified a potential area of weakness in the client’s ransomware controls.

The underwriter introduced the client to AIG’s Cyber Risk Advisors, who detailed the weakness, its potential impacts across their systems, and recommended new controls to decrease the vulnerability. The client also enrolled in CyberMatics to continuously verify the effectiveness of its controls throughout the policy period.

By leveraging AIG’s expertise, the client resolved a critical vulnerability in its systems before a claim could occur. Additionally, they benefited from more tailored policy terms at renewal with AIG’s understanding of the client’s cybersecurity practices via CyberMatics.

A successful phishing attack and a client’s lack of following the principle of  least privilege resulted in its network becoming infected with ransomware. Several servers were encrypted, and manufacturing activity was stalled. The threat actor demanded $2M bitcoin in exchange for a decryption key and an agreement not to publish sensitive information.

Working with AIG’s claims experts and partners, it was quickly determined that infected files could be restored from system backups and no ransom payment was required. AIG and expert partners also guided the client through the necessary regulatory disclosures and formal notifications, as customer and employee records had been accessed by the threat actor.

AIG’s cyber claims team and our relationships with specialized legal and forensic firms support clients’ end-to-end response to cyber events and facilitate prompt return to full operations. Additionally, CyberEdge covers legal and forensic expenses, as well as the cost of the notification efforts and related call center and credit monitoring offering.