On a Saturday night, the organisation’s IT network detected and intercepted an attempted ransomware breach. In response, the hospitality group immediately activated its incident response plan.Following initial assessment, a full system shutdown was implemented to safeguard network integrity and protect data, resulting in the temporary closure of all venues and the disabling of systems and technology.
Operations remained suspended on Sunday, with only limited use of local systems that posed no security risk. As a precaution, BPOZ, EBET, and phone lines were kept offline to ensure all servers were fully restored and uncompromised. More than 100 PCs were taken offline during this period.
The group declined to pay the ransom and successfully restored systems from backups taken approximately 18 hours prior to the encryption event. Members and guests were advised that the organisation was experiencing a technical issue, with no further disclosure required due to the effective containment of sensitive data.
Following the incident, the client participated in a cyber security training session to strengthen its understanding of cyber risk and insurance. This session was also attended by other Clubs and was well received.
Response:The policy responded to cover system damage and business interruption, including loss of profits and increased cost of working, with total incurred costs of approximately $300,000.
Working with our brokers, GSA Insurance Brokers, throughout the recent insurance renewal process has been a highly professional and collaborative experience for the Club. Given the complexity of today’s insurance market (both ISR and Public Liability) and the heightened scrutiny surrounding cyber risk, their guidance, responsiveness, and strategic advice were invaluable.
Their team demonstrated a strong understanding of both the operational realities of registered clubs and the evolving cyber risk landscape. They worked closely with management to present our risk profile accurately, articulate the significant processes of the Club businesses, and secure a practical and commercially sound outcome for the Club.
Importantly, following the cyber incident while ago, the Club undertook a significant uplift in its cyber security framework, governance, and operational controls with the support and guidance of our brokers and specialist advisors recommended by the insurers. This included strengthening internal protocols, enhancing staff awareness and training, improving system protections, implementing additional monitoring and response measures, and demonstrating a clear commitment from management and the Board toward cyber resilience.
In hindsight, it would had been beneficial to establish a relationship and understanding on the process and support available in case of a cyber incident prior to the event itself.
These initiatives were instrumental in restoring insurer confidence in the Club’s risk profile and ensuring we remained a viable and credible participant within a challenging cyber insurance market. Without these proactive improvements and the strategic support provided throughout the process, the Club could have faced materially higher premiums, increased policy excesses, reduced coverage terms, or potentially difficulty obtaining renewal terms altogether.
The ability of our brokers to effectively advocate on our behalf, present the progress made since the incident, and engage constructively with insurers delivered a strong outcome for the organisation and reinforced the importance of having an experienced and trusted advisory partner such as GSA Insurance Brokers during complex insurance renewals.
Cyber Liability Insurance offers a range of first party and third party costs that you incur following a cyber-attack, unauthorised access or privacy breach. This includes ransomware demands, forensic investigation costs, data restoration costs, privacy and security liability, regulatory fines, and more.
