Claims Examples

We often get asked how we calculate/assess Data Recovery losses. This section is intended to dig into the detail of some of our claims so as to demonstrate examples of how we will look to adjust claims in certain circumstances.

On March 12, 2020, Quantum Technologies (“Quantum”) was the victim of a ransomware attack. This event brought down a majority of Quantum’s systems, including over 300 servers and over 350 workstations. While its business operations resumed after approximately 24 hours, Quantum’s long-term recovery efforts lasted for multiple weeks.

Due to the duration of recovery efforts, Quantum purchased new laptops and reimaged impacted ones in an effort to expedite recovery.

The documents requested by Beazley

Beazley’s technical experts requested the following information:

Document	Reason for document request
Description of services and detailed time entries for all services providers involved in the Data Recovery efforts	To understand the level of effort for each of the service providers involved in the incident
Breakdown of the number of systems in the environment and the number of systems impacted	To understand the magnitude of the incident that the insured dealt with
Description of the approach involved in the Data Recovery efforts	To understand the rationale for reimaging and purchasing new laptops

Response and analysis

As a result of the ransomware attack, Quantum needed to reimage around 350 workstations and provide other services. The service providers that were present during the response efforts assisted with the reimaging of these workstations, which totalled around $73,000. These services also included providing users with temporary laptops while theirs were being reimaged to ensure that Quantum employees could operate.

In addition to the reimaging efforts, Quantum also purchased 110 laptops from various vendors, which required configuration to ensure they joined their environment and software installation to ensure that all the necessary tools were present for Quantum employees. The laptop purchases totalled around $205,000.

The result

After application of the self-insured retention, a total of $73,000 in workstation reimaging was added to the total accepted Data Recovery Costs which was $165,000. The total costs included server restoration, among other recovery-related services.

On January 7, 2022, Magic University (“Magic”) was the victim of a ransomware attack. With over 25,000 employees, Magic experienced an impact where over 300 of its virtual servers were encrypted. As a result of the incident, Magic had to recover its systems using available backups. Because of this, not only did Magic have to identify external vendors to assist with the quick restoration efforts of these servers, but it also had to acquire additional storage to support the recovery efforts.

The documents requested by Beazley

Document	Reason for document request
Description of services and detailed time entries for all services providers involved in the Data Recovery/ efforts	To understand the level of effort for each of the service providers involved in the incident
Breakdown of the number of systems in the environment and the number of systems impacted along with available storage prior to the incident	To understand the magnitude of the incident that the insured dealt with
Description of the approach involved in the Data Recovery/ efforts	To understand how the storage solution was necessary in the recovery/restoration efforts

Response and analysis

As part of the recovery process, Magic made additional copies of the impacted virtual machines to ensure they had a level of redundancy if the restoration efforts on a particular system didn’t go well. As a result, Magic needed additional storage to move virtual images and backups around to facilitate the recovery of these systems. Magic did not require double the amount of storage it originally had before the incident as it was able to integrate a cleanup process during restoration efforts, where it deleted encrypted copies of systems that were fully operational. That allowed Magic to maximize efficiency and storage space as it recovered. Therefore, Magic rented 150 terabytes (TB) of temporary storage for two (2) months to facilitate these efforts.

The result

A total of $18,000 for a storage rental solution was recognized for coverage in addition to other covered costs for this claim.

On June 10, 2020, Biochrome Labs (“Biochrome”) was the victim of a ransomware attack. While Biochrome has over 15,000 workstations and 1,500 servers, around 710 workstations and 550 servers were impacted. As a result, Biochrome needed to restore its impacted workstations and servers as quickly as possible. Fortunately, its backups were intact, and the servers were restored using available backups. However, for the workstations, Biochrome needed to identify an alternative solution that could get the impacted users operational as quickly as possible.

The documents requested by Beazley

Document	Reason for document request
Description of services and detailed time entries for all services providers involved in the Data Recovery efforts	To understand the level of effort for each of the service providers involved in the incident
Breakdown of the number of systems in the environment and the number of systems impacted along with available storage prior to the incident	To understand the magnitude of the incident that the insured dealt with

Response and analysis

While the ransomware incident didn’t fully impact Biochrome’s operations, Biochrome needed to get at least 635 workstations operational as quickly as possible, as those workstations belonged to key members of its sales team. Therefore, rather than purchasing new devices or reimaging systems, which would have taken longer, Biochrome decided to temporarily rent workstations. This enabled it to obtain temporary devices quickly, at a lower cost, while the company’s IT team reimaged its systems in parallel. Not only did this allow it to quickly get its sales team operational, but also gave the internal IT team more breathing room as the company had working computers with the essential tools for the impacted users. The rental cost for each of these devices varied due to the type of laptop that was rented, but it averaged at around $198.70 per laptop per month.

The result

A total of around $125,000 for the rental of workstations was added to the accepted total for Extra Expense.

Claims Examples

Hardware reimaging and replacement

Additional storage costs

Workstation rental

Related Content

Common Misconceptions

Process Overview

Policy Wording

Contact us

FOR BROKERS

For Customers