Exclusive first look at Coalition’s new cyber claims dataGet the 2024 Cyber Claims Report
Cyber Incident? Get Help


Construction company’s compromised email leads to invoice manipulation

Construction worker laying out vinyl flooring




  • Employees: Less than 50

  • Coverages: Invoice Manipulation, Breach Response

A construction company specializing in demolition and abatement invoiced a vendor for $56,000. The vendor followed the email instructions and paid the invoice, but the money never arrived.

After they contacted Coalition Claims, we immediately got to work. The construction company initiated its Breach Response coverage¹ and engaged in a forensic investigation with Coalition Incident Response (CIR) to determine whose system was compromised. CIR found that a construction company employee’s email was compromised and led to the breach, triggering the Invoice Manipulation coverage included in their policy.²

At the guidance of our Claims team, the construction company spoke to their vendor to determine how they would recover the $56,000. The vendor did not have its own insurance but agreed to pay $28,000, while the construction company’s policy covered the rest, totaling $25,500 after their $2,500 self-insured retention.

Coalition² brings together active monitoring, incident response, and comprehensive insurance to solve cyber risk. To learn more, visit coalitioninc.com.

1. Breach response included the engagement of an incident response firm; the insured selected Coalition Incident Response. 2. The claim scenarios described here are intended to show the types of situations that may result in claims. These scenarios should not be compared to any other claim. Whether or to what extent a particular loss is covered depends on the facts and circumstances of the loss, the terms and conditions of the policy as issued and applicable law.