Insurer asked for 'digital forensic evidence' after a breach — what is this, and who collects it?

The first thing you need to do right now is NOT shut down those computers and never reboot them. Just disconnect them from the network by unplugging the ethernet cable or turning off Wi-Fi. If you power them off, any attacker traces in volatile memory (RAM) get wiped, destroying the evidence.

We went through a similar fake invoice incident and lost 36,000 GBP. A digital forensics firm on the insurer's panel pulled the images within two days. The reporting came out to 6,500 GBP; we covered our 2,500 GBP policy excess, and the insurer reimbursed both the rest of the report fee and the full stolen amount.

Review the 'Proof of Loss and Burden of Proof' clause in your policy's terms and conditions carefully. Reports prepared by third-party experts not pre-approved by the insurer can be procedurally dismissed by the claims committee.

Screenshots don't cut it as evidence because local logs, source IPs, user session tokens, and inbox rules all need to be audited. The attacker might have set up a hidden forwarding rule in the accountant's mailbox; a forensics expert will uncover that from audit logs and attach it to the report with hash verification.

Insurers often use evidence requirements as an excuse to avoid paying out or to drag the process on for months. If you don't follow the procedure down to the letter, they'll claim you contaminated your own evidence and close the file right then and there. Be extremely careful.

Did your cyber policy include 'Incident Response and Forensic Investigation Coverage' when you bought it? If you have that rider, the insurer is required to dispatch the forensics team themselves; they can't push the burden of sourcing a vendor onto you.

note: I wrote this based on my own experience, it might not apply to everyone.

don't even think about deleting the outlook profile on the accountant's pc. every single deleted file raises red flags leave it as is and wait for the expert to arrive.

My question might sound amateurish, sorry about that. Security isn't absolute; it's about making attacks not worth the effort.

That's all, sorry if I went on too long.

My questions are cleared up, thanks.

If I understood correctly, you're saying: If permission and scope aren't in writing, don't start that test.

If you get three different answers on a topic, the question was asked wrong. This is my opinion, I'm not claiming it's absolute truth.

The discussion got scattered let me summarize. I mean security isn't absolute; it's about making attacks not worth the effort.

This is my opinion I'm not claiming it's absolute truth.

To get into the details: Having backups accessible on the same network and with the same identity makes them part of the target.

Most time waste accumulates in tasks waiting for approval. Correct me if I'm wrong.

I'm curious too. Security isn't absolute; it's about making attacks not worth the effort.

If you post the result here, it will help others too.

don't miss this: If you scold false alarms nobody will report again.

that's all srry if I went on too long.

The opposite happened to me that's why I'm writing. When we decide without measuring, we always end up in the same place.

The biggest time-waster for us was not knowing who had the final say. I'm also curious if anyone does it differently.

There's a trap here, let me mention it. Payment information changes are never verified through the channel they came from.

I'm also curious if anyone does it differently.

I felt relieved reading this answer, so it's not just me. Hasty decisions become decisions you have to fix six months later.

The real issue isn't the number, but what it's based on. That's all, sorry if I went on too long.

absolutely then if I were to add anything: Start with a small trial; dont commit to everything at once.

taking measures without an inventory leaves doors you haven't seen open.