It All Started with a File
Not long ago, one of our clients faced a serious cyber attack that shut down their system and disrupted their entire operation.
One morning, they turned on their computers and found something chilling.
Every single folder, every directory—infected. A mysterious file named README19.txt had been silently planted across their system. This wasn’t a mistake or a system glitch. It was a ransom note. And it was everywhere.
The note was a direct message from cybercriminals. In it, they claimed to have infiltrated the company’s network, stolen sensitive data, and encrypted all access. Their demand? Over $250,000 USD. The threat was clear: pay up or face the release of your trade secrets, internal documents, and client data on the dark web.
It’s the kind of nightmare that keeps business owners up at night.
Not If, But When
This attack wasn’t theoretical. It wasn’t from a movie. It happened to a real business, to a real client of ours. And while they were no stranger to traditional claims like property damage or auto losses, this one hit differently. It was invasive, high-stakes, and deeply personal.
What made the difference? They picked up the phone and called us immediately.
Instead of trying to fix things on their own or waiting for their IT partner, they turned to us. That call activated their cyber liability insurance policy, which was designed to respond precisely to this kind of crisis.
What Happened Next
The moment the claim was submitted, things moved fast. Within hours, the insured was working with:
- A breach coach who provided expert guidance on how to manage the situation
- Negotiators, who communicated directly with the attackers
- IT forensic specialists tasked with identifying the breach’s origin and scope
- Data recovery teams ready to help restore files if needed
The insured was kept in the loop every step of the way. And while the experience was still stressful, they continually commented on how reassured they felt knowing the experts were handling it.
It was no longer a business crisis. It was a managed response.
The Ransom Note: A Chilling Example
The ransom note itself outlined the attacker’s “terms,“ claiming:
- They weren’t trying to ruin the business, just extract money.
- Payment would allegedly result in a decryption key.
- Delays or attempts to fix things independently would lead to data loss or permanent leaks.
- If ignored, the stolen data would be auctioned off to other criminals.
And in bold print, they reminded the company:
Cybercriminals count on panic to gain the upper hand. But this client had a plan—and responded with control, not chaos.
What Would You Do?
This incident could’ve ended very differently.
Without a cyber policy:
- The client may have paid the ransom out of pocket (with no guarantee the data would be returned).
- They could’ve lost access to all their files permanently.
- Their customers’ sensitive data might be exposed, leading to reputational damage and legal consequences.
Most businesses still think, “It won’t happen to us.“ But this case proves otherwise. It’s not a matter of if but when.
Cyber Liability Insurance Coverage: What It Brings to the Table
A strong cyber insurance policy doesn’t just write cheques—it delivers:
- Immediate access to experts: Legal, forensic, and negotiation teams are on standby.
- Coverage for ransom payments (when deemed appropriate and legal).
- Assistance with breach notification laws and regulatory compliance.
- Reputation management services to help navigate public fallout.
- Business interruption protection, helping recover lost income due to downtime.
Final Thoughts: Be the First Call
In this case, the insured made the right first move. They called us even before their IT team. That call made all the difference.
When a cyber-attack hits, your first instinct might be to call your IT provider. After all, it feels like a tech problem. But here’s the thing—your response in those first moments can make or break your coverage.
Calling your broker first activates your cyber policy the right way. Insurers often have strict protocols around handling a breach to ensure the claim is valid. If your IT team starts poking around or trying to fix things before the insurer’s breach coach or forensic team gets involved, it can compromise digital evidence, delay the investigation, or even void parts of your policy.
Brokers know the exact steps to trigger the support built into your coverage. They connect you with pre-approved vendors, legal advisors, and negotiators specializing in managing ransomware, data theft, and system restoration. Starting with your broker ensures the claim is clean, compliant, and fully supported from minute one.
As brokers, we need to ask ourselves—would your client know what to do? And would they have the right coverage when it counts?
Cyber threats are evolving. So should your clients’ protection.
About Wedgwood Insurance
Wedgwood Insurance has offices in St. John’s & Corner Brook and is Newfoundland & Labrador’s largest independent insurance broker. We provide straightforward home, auto & business insurance advice.
With over 325 Google My Business reviews, experience the Wedgwood difference with expert advice from our dedicated team. We ensure that every client has the coverage that best suits their needs through upfront complimentary consultations and midterm reviews.
Contact Us
