A PR company noticed a problem with its emails. Its regular IT contractor investigated and concluded that the most likely cause was malicious activity. The business contacted their insurer, who then deployed an IT forensics team on-site to investigate and confirmed the company had indeed been the victim of a malware attack. It also confirmed that the hackers who deployed the malware had accessed the insured’s systems and that personal data was potentially compromised. 

After investigating the extent of the breach, the IT team removed the malware and plugged the gap in the PR company’s security that had allowed the breach. The insurer then engaged legal counsel to advise the insured on its notification obligations, and then arranged the notification of the regulator and relevant data subjects.