Digital risk impacts all businesses
See how Coalition helped its US policyholders recover from digital risks through our unique approach to active monitoring, incident response, and comprehensive insurance
![Woman analyzing risk on her ipad in her furniture shop](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2r6b4fp5LnTQ3EJ5DaTnZM%2F10e16e6ee606ea1df529af178531f2cc%2FCase-Studies_Hero.png&w=3840&q=75)
Explore our case studies
![CaseStudy-Thumb Tech-SocialEngineering](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F11oRAaohDnFvbBDKC4ad3V%2Ff13188aaf19ecadc0f92f2b4c6f404d8%2FCaseStudy-Thumb_Tech-SocialEngineering.png&w=3840&q=75)
Technology company avoids social engineering scam
When Project 529 was approached by a company reporting high-cost vulnerabilities to its bug bounty program, Coalition stepped in.
![Two tradesman enjoying their lunchbreak](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2Q1JK1KnrcbHed4g9zSKlQ%2Ffe7080ba4bd7e072a6fa89303af77730%2FCaseStudy-Thumb_FTFClawBack.png&w=3840&q=75)
$5.5M recovered from fraudulent transfer
Coalition worked with law enforcement to recover $5.5M from an international bank account and covered an additional $500K in FTF.
![CaseStudy-Thumb Nonprofit-Data-Breach](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F29MZFGAJ6Sm9X4jfdxu2Yr%2Fb7331f9dce6b85960f9bf34c5ee993c3%2FCaseStudy-Thumb_Nonprofit-Data-Breach.png&w=3840&q=75)
Nonprofit software breach creates data privacy fallout
An international nonprofit managed the fallout of a data breach spanning across numerous countries with the help of Coalition.
![CaseStudy-Thumb Cyber-Tax-Fraud](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3AUrxxkG2wTtO7NTA9s4or%2F66d7751c5f4168e771c831f109e7d210%2FCaseStudy-Thumb_Cyber-Tax-Fraud.png&w=3840&q=75)
Threat actors steal tax returns from accounting firm
See how Coalition helped a small accounting firm navigate a cyber event that led to fraudulent tax filings for dozens of its clients.
![Dentist showing mouth xray to patient](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4RgWJlAATdx6gC8Q7TGq9y%2Faf4dee9d8c6be8a0e2e4d7a49958e2ce%2FCaseStudy-Thumb_Dental.png&w=3840&q=75)
Dental office avoids ransom payment
A nationwide dental office restored from backups when they were hit with ransomware — Coalition helped cover their business interruption costs.
![Financial firm executives analysing risk on their laptop](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F69SBXisFJ7QEStrcLUSwB7%2F55f81204c0f48838648efd5b938e1339%2FCaseStudy-Thumb_Ransomware-FinancialAdvisorFTF.png&w=3840&q=75)
Firm recovers $3.5M without filing a claim
Coalition worked with a financial firm’s bank to recover all but $405 of $3.5M of fraudulently transferred funds.
![CaseStudy-Thumb Technology Ransomware](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3YsSKQbTyOScYmPHuf4jyl%2Fddc983ebbfba1ffc6e779fa56ec5012b%2FCaseStudy-Thumb_Technology_Ransomware.png&w=3840&q=75)
Technology company inoperable for weeks due to ransomware
A transcription company leaned on Coalition to negotiate a $2.5M ransom demand after its backups were deemed unusable.
![CaseStudy-Thumb Healthcare DeviceTheft](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4Ya3f1KmGVbRgQyCnYke5D%2Fd8d4d2e25ea46d8a167aa0b49f21d3b0%2FCaseStudy-Thumb_Healthcare_DeviceTheft.png&w=3840&q=75)
Former contractor disrupts operation after stealing devices
After a contractor stole devices and disrupted operations. Coalition helped replace the hardware and got them back to business.
![CaseStudy-Thumb Coffee Co DDoS](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6LHry6liMymvciwmbZmBus%2Fa6302fa842fba0ae94bd9f062f52f9c5%2FCaseStudy-Thumb_Coffee_Co_DDoS.png&w=3840&q=75)
DDoS attack prevents retailer from operating
Business Interruption coverage helped recoup lost revenue during one of the year's busiest weekends for this coffee company.
![Mechanic working on a machine](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2yzTDOxU3AeLf3QZxEaFR5%2F170f81801578b3fe18d813415ac51747%2FCaseStudy-Thumb_ManufacturerRansomwareBackUps.png&w=3840&q=75)
Manufacturer resumes operations after data compromise
A manufacturer worked with Coalition Incident Response to negotiate a ransom when they couldn’t fully restore from backups.
![Real estate agent showing a house to a couple](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3xfweVLSRTJhVdUVEnMPAx%2Fd01862baddd757894c9f9cc24f4b9797%2FCaseStudy-Thumb_RealEstate-PropertyManager.png&w=3840&q=75)
Compromised vendor leads to fraudulent transfer
A property manager’s bookkeeping vendor experienced an email compromise that led to $180,000 in funds transfer fraud losses.
![CaseStudy-Thumb Education DataBreach](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3sZrntwuQzmGlqaNZqH8bC%2F978620ba9fc2a04d75027d7a22c42eb3%2FCaseStudy-Thumb_Education_DataBreach.png&w=3840&q=75)
School investigates potential data compromise
A school’s former employee’s strange behavior caught on video led them to believe a data breach occurred.
![CaseStudy-Thumb Breach Real-Estate](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4hURHPrnI9rWuZ5zUxlVUm%2Fa45d3db831c54e2b3a458afcb363ca2e%2FCaseStudy-Thumb_Breach_Real-Estate.png&w=3840&q=75)
Customer data leak caused by CEO's breached inbox
Coalition assisted a real estate company recover from the CEO’s compromised email and subsequent data breach.
![CaseStudy-Thumb ConstructionRansomware](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F7dpyC4cfzwv0GKIe9eSm54%2F8ab2df002a746d1500ab921ce8c26c51%2FCaseStudy-Thumb_ConstructionRansomware.png&w=3840&q=75)
Construction client requires strict protocol after data exfiltration
Coalition helped with notification requirements after a threat actor stole data that included potentially protected government information.
![Healthcare officer looking at data on the computer](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F5z68JYnrnAllvtM3s0JBIh%2Fe56b6ebf209dda37f98adc0fe9c7bb81%2FCaseStudy-Thumb_HealthcareRansomware.png&w=3840&q=75)
Significant losses covered for medical office
A medical office had nearly $800k in losses from a ransomware attack covered by Coalition.
![CaseStudy-Thumb Breach MFA-Restaurant](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4PXuJ9RmNJKhiKEF5NkjpY%2F692fc18efd099dba735ac30c7733d197%2FCaseStudy-Thumb_Breach_MFA-Restaurant.png&w=3840&q=75)
Restaurant customers' credit card data compromised
Coalition helped a restaurant group respond to and cover a $3M claim after the FBI alerted them to a potential compromise.
![non profit executive smiling in a brightly lit office](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F5aIvMGDJ6KKx5iZwXysVu7%2F9e1ce8c4dee6117d72aac98389a4a492%2FCaseStudy-Thumb_UKNonprofitCryptojacking.png&w=3840&q=75)
Nonprofit suffers cryptojacking event
Coalition’s Service Fraud coverage helped a nonprofit after a threat actor mined cryptocurrencies on their dime.
![executives on a zoom call discussing cyber threats](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6s6BoJcXYpFmbSuQAdkJiO%2F7c0d09112bf5aeb44fc2c0be9002c221%2FCaseStudy-Thumb_AssetManagementFirmRansomware.png&w=3840&q=75)
Financial firm minimizes ransom payout
When an asset management firm’s partner saw their name on the dark web, the pressure was on the firm to pay its ransom to protect the partner’s data.
![Card transaction over the counter](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1TQUSoyhyZGnAhzX5ceOET%2Fe1487d3523ae60d5af83b9dcf3a84ea0%2FCaseStudy-Thumb_Stolen-Funds.png&w=3840&q=75)
Tech company has full funds recovery after spoofed email
A company wired $200,000 to a hacker impersonating their CFO. Coalition recovered $150,000 within 24 hours of receiving the call, and their insurance policy covered the rest.
![Lawyer working with Coalition on the phone](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4pFHZtLRZSyn2xN2tMbUb8%2Fb001bec15a4c17d4a1fbed43ce7c95b8%2FCaseStudy-Thumb_LawFirmRansomware.png&w=3840&q=75)
Law firm battles ransomware
A law firm came to terms with Coalition Incident Response negotiating their ransom when they learned sensitive client data had been exfiltrated.
![steel manufacturer in the workshop](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3K8HCLjXTaOmkEuMLQhAy7%2F9937ba950c3e87b8bb1d471280837ca1%2FCaseStudy-Thumb_Ransomware-Manufacturing.png&w=3840&q=75)
Manufacturer avoids paying ransom
Coalition Incident Response worked with law enforcement to source the decryption keys for this manufacturer—allowing them to recover without paying the ransom.
![Councilor signing documents](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F553242DHu8wE2a8htjDSSu%2Fae5416292a89b82ba38cf69217568fde%2FCaseStudy-Thumb_Municipality.png&w=3840&q=75)
Breach coverage allows municipality to investigate early
When a municipality had suspicious EDR alerts, they contacted Coalition to help them discover any nefarious activity.
![Carpenter working on the flooring](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1NORKyCmDLTigEUorh6oND%2Fa327420d16fb427c648fbfef0ebca103%2FCaseStudy-Thumb_Construction.png&w=3840&q=75)
Construction company finds breach source with CIR
A construction company’s Invoice Manipulation coverage was triggered when an employee’s compromised email enabled a threat actor to steal a $56,000 invoice payment.
![Lawyer brooding over cyber claims](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F38QqUzEv4TNaoYlQ1mv4pn%2F0290fccce4bf5dcbb8f9632fc598487a%2FCaseStudy-Thumb_LawFirmFTF.png&w=3840&q=75)
Law firm fully covered after funds transfer fraud
A fake client scammed a law firm into a fraudulent transfer, which was covered by their Funds Transfer Fraud coverage.
![Manufacturer in a workshop](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F6aCtCvPIlXy8PWybBXb5o5%2F399558fa2264b83b0aa1ed7799be836b%2FCaseStudy-Thumb_Manufacturer.png&w=3840&q=75)
Pet supply manufacturer avoids debilitating ransom losses
After negotiating a ransom payment, a manufacturer didn’t receive decryption keys and spent three weeks restoring from backups.
![Tech company team discussing cyber risks](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4JtpOX9Df7SxtjR73iTJe3%2F6af7b730fb567377e37a9b4defea4ed5%2FCaseStudy-Thumb_EnvironmentalTech.png&w=3840&q=75)
Tech company combats social engineering scam
Two threat actors worked in tandem to trick this company’s bank into authorizing transactions totaling nearly $500,000.
![Tech company employee looking over cyber risks on the laptop](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2WjItu5FAeKIaJqC5jmMmo%2F6e75d5f90d4a125441fbe2bfb47f635f%2FCaseStudy-Thumb_Ransomware.png&w=3840&q=75)