Situation

Based in New England, a large lab company that specialized in water, soil and environmental testing was the victim of a large ransomware attack. The cyber attackers held the company’s digital systems for ransom, paralyzing its operations for more than two weeks.

Even after the company worked with a third party to negotiate and pay the ransom to regain access to some data, leaders were faced with wasted samples from the elapsed time, along with lost data and a massive operational setback.

While the company’s cyber coverage paid for a portion of the ransom, the company was experiencing issues with their insurance claim for lost business revenue, both during and after the attack.

Solution

The lab was referred to the forensic accounting team at Springline Advisory for its expertise in working with companies as they negotiate claims with insurance companies.

The team started with truly understanding the lab’s insurance coverage, said Jim Marasco, managing partner.

“We’re not going to go barking up the wrong tree,” he said. “We’ve got to understand what the coverage is and then what their loss is, and how they’ve been impaired by the peril that occurred.”

In addition to the lost revenue during the period of partial operations, the company incurred additional costs by having to retest many of the samples from that period. The Springline team also had to consider the company’s “saved costs” to get the full picture of the revenue change.

“Let’s just say they didn’t have to pay any of the employees for two weeks,” Marasco said. “Well, that’s a saved cost that benefited them. So, there’s a lot of accounting to calculate the true loss of business and the lost opportunities.”

The team also worked closely with the company’s agent, who served as the go-between with the lab and the insurance company.

After completing its full forensic accounting process, the team presented the entire loss results in an organized, easy-to-read format that could easily be substantiated, Marasco said.

“We’re not just throwing darts at a wall. It has to withstand scrutiny,” he said. “It has to be clear, concise, and supported with numbers and factual information behind it. We were able to build credible schedules for every aspect of their loss.”

Results

After presenting detailed calculations and schedules to the insurance company, the lab received more than $5 million for the loss suffered from the cyberattack — nearly the entire amount requested by the Springline team.

“In the end, we got almost everything we were looking for,” Marasco said. “It really showed the value of thoroughly examining the numbers and presenting an airtight argument.”