A furniture manufacturer learned it had been hit with a ransomware attack after discovering a ransom note on a company computer. Threat actors encrypted its data and rendered nearly all systems inoperable, bringing business operations to a halt. The manufacturer contacted Coalition and quickly engaged Coalition Incident Response (CIR)¹ to lead a forensics investigation.

After exfiltrating 420GB of data, threat actors contacted current and former employees, leveraging the stolen data to pressure the manufacturer into paying the ransom. Because the threat actors corrupted all onsite backups, the manufacturer decided to pay the ransom in exchange for a decryptor and to prevent threat actors from leaking private data.

CIR successfully negotiated the ransom demand down from $682,500 to $400,000. However, the decryptor provided by threat actors was ineffective. CIR and restoration vendors provided hands-on support for one month to get the manufacturer operational. Ultimately, CIR determined that initial access was gained through remote desktop software. Throughout the recovery process, Coalition provided proactive support through legal vendors to notify all impacted parties of the breach and offered credit monitoring.

After the manufacturer paid its $25,000 self-insured retention, Business Interruption coverage responded with $609,000 to help cover the extended downtime. Additional costs were covered through a separate $1 million limit for Breach Response coverage for notifications, data mining, and legal and forensic vendors.

1. Coalition Incident Response services provided through Coalition’s affiliate are offered to policyholders as an option via our incident response firm panel.

The claim scenarios described here are intended to show the types of situations that may result in claims. These scenarios should not be compared to any other claim. Whether or to what extent a particular loss is covered depends on the facts and circumstances of the loss, the terms and conditions of the policy as issued and applicable law. Facts may have been changed to protect the privacy of the parties involved.

Insurance products are offered in the U.S. by Coalition Insurance Solutions Inc. (“CIS”), a licensed insurance producer and surplus lines broker, (Cal. license # 0L76155) acting on behalf of a number of unaffiliated insurance companies, and on an admitted basis through Coalition Insurance Company (“CIC”) a licensed insurance underwriter (NAIC # 29530). See licenses and disclaimers. Copyright © 2025. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc