Digital risk impacts all businesses
See how Coalition helped businesses recover from digital risks through our unique approach to active monitoring, incident response, and comprehensive cyber insurance
![Woman analyzing risk on her ipad in her furniture shop](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2r6b4fp5LnTQ3EJ5DaTnZM%2F10e16e6ee606ea1df529af178531f2cc%2FCase-Studies_Hero.png&w=3840&q=75)
Explore our case studies
![CaseStudy-Thumb Tech-SocialEngineering](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F11oRAaohDnFvbBDKC4ad3V%2Ff13188aaf19ecadc0f92f2b4c6f404d8%2FCaseStudy-Thumb_Tech-SocialEngineering.png&w=3840&q=75)
Technology company avoids social engineering scam
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![Two tradesman enjoying their lunchbreak](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2Q1JK1KnrcbHed4g9zSKlQ%2Ffe7080ba4bd7e072a6fa89303af77730%2FCaseStudy-Thumb_FTFClawBack.png&w=3840&q=75)
$5.5M recovered from fraudulent transfer
Coalition worked with law enforcement to recover $5.5M from an international bank account and covered an additional $500K in FTF.
![CaseStudy-Thumb Nonprofit-Data-Breach](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F29MZFGAJ6Sm9X4jfdxu2Yr%2Fb7331f9dce6b85960f9bf34c5ee993c3%2FCaseStudy-Thumb_Nonprofit-Data-Breach.png&w=3840&q=75)
Nonprofit software breach creates data privacy fallout
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![CaseStudy-Thumb Cyber-Tax-Fraud](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3AUrxxkG2wTtO7NTA9s4or%2F66d7751c5f4168e771c831f109e7d210%2FCaseStudy-Thumb_Cyber-Tax-Fraud.png&w=3840&q=75)
Threat actors steal tax returns from accounting firm
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![Dentist showing mouth xray to patient](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4RgWJlAATdx6gC8Q7TGq9y%2Faf4dee9d8c6be8a0e2e4d7a49958e2ce%2FCaseStudy-Thumb_Dental.png&w=3840&q=75)
Dental office avoids ransom payment
A nationwide dental office restored from backups when they were hit with ransomware — Coalition helped cover their business interruption costs.
![Financial firm executives analysing risk on their laptop](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F69SBXisFJ7QEStrcLUSwB7%2F55f81204c0f48838648efd5b938e1339%2FCaseStudy-Thumb_Ransomware-FinancialAdvisorFTF.png&w=3840&q=75)
Firm recovers $3.5M without filing a claim
Coalition worked with a financial firm’s bank to recover all but $405 of $3.5M of fraudulently transferred funds.
![CaseStudy-Thumb Technology Ransomware](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3YsSKQbTyOScYmPHuf4jyl%2Fddc983ebbfba1ffc6e779fa56ec5012b%2FCaseStudy-Thumb_Technology_Ransomware.png&w=3840&q=75)
Technology company inoperable for weeks due to ransomware
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![CaseStudy-Thumb Healthcare DeviceTheft](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4Ya3f1KmGVbRgQyCnYke5D%2Fd8d4d2e25ea46d8a167aa0b49f21d3b0%2FCaseStudy-Thumb_Healthcare_DeviceTheft.png&w=3840&q=75)
Former contractor disrupts operation after stealing devices
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![CaseStudy-Thumb Coffee Co DDoS](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6LHry6liMymvciwmbZmBus%2Fa6302fa842fba0ae94bd9f062f52f9c5%2FCaseStudy-Thumb_Coffee_Co_DDoS.png&w=3840&q=75)
DDoS attack prevents retailer from operating
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![Mechanic working on a machine](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2yzTDOxU3AeLf3QZxEaFR5%2F170f81801578b3fe18d813415ac51747%2FCaseStudy-Thumb_ManufacturerRansomwareBackUps.png&w=3840&q=75)
Manufacturer resumes operations after data compromise
A manufacturer worked with Coalition Incident Response to negotiate a ransom when they couldn’t fully restore from backups.
![Real estate agent showing a house to a couple](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3xfweVLSRTJhVdUVEnMPAx%2Fd01862baddd757894c9f9cc24f4b9797%2FCaseStudy-Thumb_RealEstate-PropertyManager.png&w=3840&q=75)
Compromised vendor leads to fraudulent transfer
A property manager’s bookkeeping vendor experienced an email compromise that led to $180,000 in funds transfer fraud losses.
![CaseStudy-Thumb Education DataBreach](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3sZrntwuQzmGlqaNZqH8bC%2F978620ba9fc2a04d75027d7a22c42eb3%2FCaseStudy-Thumb_Education_DataBreach.png&w=3840&q=75)
School investigates potential data compromise
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![CaseStudy-Thumb Breach Real-Estate](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4hURHPrnI9rWuZ5zUxlVUm%2Fa45d3db831c54e2b3a458afcb363ca2e%2FCaseStudy-Thumb_Breach_Real-Estate.png&w=3840&q=75)
Customer data leak caused by CEO's breached inbox
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![CaseStudy-Thumb ConstructionRansomware](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F7dpyC4cfzwv0GKIe9eSm54%2F8ab2df002a746d1500ab921ce8c26c51%2FCaseStudy-Thumb_ConstructionRansomware.png&w=3840&q=75)
Construction client requires strict protocol after data exfiltration
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![Healthcare officer looking at data on the computer](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F5z68JYnrnAllvtM3s0JBIh%2Fe56b6ebf209dda37f98adc0fe9c7bb81%2FCaseStudy-Thumb_HealthcareRansomware.png&w=3840&q=75)
Significant losses covered for medical office
A medical office had nearly $800k in losses from a ransomware attack covered by Coalition.
![CaseStudy-Thumb Breach MFA-Restaurant](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4PXuJ9RmNJKhiKEF5NkjpY%2F692fc18efd099dba735ac30c7733d197%2FCaseStudy-Thumb_Breach_MFA-Restaurant.png&w=3840&q=75)
Restaurant customers' credit card data compromised
Coalition actively protects organisations from ransomware, and in case of an incident, we quickly respond to help mitigate vulnerabilities and reduce loss.
![non profit executive smiling in a brightly lit office](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F5aIvMGDJ6KKx5iZwXysVu7%2F9e1ce8c4dee6117d72aac98389a4a492%2FCaseStudy-Thumb_UKNonprofitCryptojacking.png&w=3840&q=75)
Nonprofit suffers cryptojacking event
Coalition’s Service Fraud coverage helped a nonprofit after a threat actor mined cryptocurrencies on their dime.
![executives on a zoom call discussing cyber threats](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6s6BoJcXYpFmbSuQAdkJiO%2F7c0d09112bf5aeb44fc2c0be9002c221%2FCaseStudy-Thumb_AssetManagementFirmRansomware.png&w=3840&q=75)
Financial firm minimizes ransom payout
When an asset management firm’s partner saw their name on the dark web, the pressure was on the firm to pay its ransom to protect the partner’s data.
![Card transaction over the counter](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1TQUSoyhyZGnAhzX5ceOET%2Fe1487d3523ae60d5af83b9dcf3a84ea0%2FCaseStudy-Thumb_Stolen-Funds.png&w=3840&q=75)
Tech company has full funds recovery after spoofed email
A company wired $200,000 to a hacker impersonating their CFO. Coalition recovered $150,000 within 24 hours of receiving the call, and their insurance policy covered the rest.
![Lawyer working with Coalition on the phone](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4pFHZtLRZSyn2xN2tMbUb8%2Fb001bec15a4c17d4a1fbed43ce7c95b8%2FCaseStudy-Thumb_LawFirmRansomware.png&w=3840&q=75)
Law firm battles ransomware
A law firm came to terms with Coalition Incident Response negotiating their ransom when they learned sensitive client data had been exfiltrated.
![steel manufacturer in the workshop](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3K8HCLjXTaOmkEuMLQhAy7%2F9937ba950c3e87b8bb1d471280837ca1%2FCaseStudy-Thumb_Ransomware-Manufacturing.png&w=3840&q=75)
Manufacturer avoids paying ransom
Coalition Incident Response worked with law enforcement to source the decryption keys for this manufacturer—allowing them to recover without paying the ransom.
![Councilor signing documents](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F553242DHu8wE2a8htjDSSu%2Fae5416292a89b82ba38cf69217568fde%2FCaseStudy-Thumb_Municipality.png&w=3840&q=75)
Breach coverage allows municipality to investigate early
When a municipality had suspicious EDR alerts, they contacted Coalition to help them discover any nefarious activity.
![IT team looking over cyber risks](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3T7gbqrQw7NHZTh6YKEinb%2Fdd75edf1bb3b5493563d1951c13b24a1%2FCaseStudy-Thumb_Phishing.png&w=3840&q=75)
Phishing attacks trigger claims
Three different companies experienced claims that started with phishing attacks.
![Carpenter working on the flooring](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1NORKyCmDLTigEUorh6oND%2Fa327420d16fb427c648fbfef0ebca103%2FCaseStudy-Thumb_Construction.png&w=3840&q=75)
Construction company finds breach source with CIR
A construction company’s Invoice Manipulation coverage was triggered when an employee’s compromised email enabled a threat actor to steal a $56,000 invoice payment.
![Lawyer brooding over cyber claims](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F38QqUzEv4TNaoYlQ1mv4pn%2F0290fccce4bf5dcbb8f9632fc598487a%2FCaseStudy-Thumb_LawFirmFTF.png&w=3840&q=75)
Law firm fully covered after funds transfer fraud
A fake client scammed a law firm into a fraudulent transfer, which was covered by their Funds Transfer Fraud coverage.
![Manufacturer in a workshop](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6aCtCvPIlXy8PWybBXb5o5%2F399558fa2264b83b0aa1ed7799be836b%2FCaseStudy-Thumb_Manufacturer.png&w=3840&q=75)
Pet supply manufacturer avoids deibilitating ransom losses
After negotiating a ransom payment, a manufacturer didn’t receive decryption keys and spent three weeks restoring from backups.
![Tech company team discussing cyber risks](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4JtpOX9Df7SxtjR73iTJe3%2F6af7b730fb567377e37a9b4defea4ed5%2FCaseStudy-Thumb_EnvironmentalTech.png&w=3840&q=75)
Tech company combats social engineering scam
Two threat actors worked in tandem to trick this company’s bank into authorizing transactions totaling nearly $500,000.
![Tech company employee looking over cyber risks on the laptop](/_next/image?url=https%3A%2F%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2WjItu5FAeKIaJqC5jmMmo%2F6e75d5f90d4a125441fbe2bfb47f635f%2FCaseStudy-Thumb_Ransomware.png&w=3840&q=75)