Forest Global Training Partners

Cyber Risks · Krebs on Security

The Case for Cybersecurity Insurance, Part I

Summary: Golden State Bridge Inc., a Martinez, Calif. construction company, had online banking credentials stolen by an unclassified strain of malware, and on May 19 thieves used that access to set up fraudulent ACH payroll payments totaling more than $125,000 to a dozen money mules. CFO Ann Talbot caught the transfers the next day and canceled seven further batches worth several hundred thousand dollars, but most mules at East Coast banks had already withdrawn the first two batches, leaving a loss just shy of $100,000 against $1 million in cybersecurity insurance bought through Arch Insurance Group.

What's compelling: The company had dual controls requiring separate initiation and approval of payroll batches, but had disabled them for a special case and never restored them - and the bank's secret-question re-verification landed the day before the fraud began. Talbot's worry is that after this claim the coverage may not be offered again, or only at a prohibitive price.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related