MGA Vendor Ransomware: The First 72 Hours
Harbor Point Specialty, an MGA writing 38,000 small commercial package policies, uses a cloud rating and policy-issuance platform from a vendor, RateCore. On a Friday, RateCore discloses that ransomware encrypted its production environment, including the rating engine and a document store holding scanned applications, loss runs, and driver's license images for Harbor Point insureds. RateCore says restoration from backup will take five to ten days. The MGA's binding authority continues, but agents cannot generate quotes or issue certificates. Harbor Point's incident response plan was written for its own data center and says nothing about vendor-hosted systems. The vendor contract is a standard SaaS agreement with a 99.5% uptime SLA, a $50,000 liability cap, and no security exhibit. The CEO wants to send a customer notice immediately; the general counsel wants to wait for RateCore's forensic report; the carrier that delegates binding authority has asked for a written update within 48 hours.
1. Identify the decisions that must be made in the first 72 hours and who should own each.
Read the worked answer
Assign one incident commander and separate the decisions; several are being run together and will collide.
Facts and scope (owner: incident commander with RateCore). What data categories are confirmed present and encrypted, is exfiltration confirmed or merely possible, are backups immutable and tested, and what is the restoration sequence and ETA. Do not accept a status page as the record.
Business continuity (owner: COO). Approve manual workarounds: paper quote and bind procedures, certificate issuance authority, delegated-authority limits, and how the policy register is reconstructed. Manual binding without register control creates duplicate policies and unauthorized commitments, so the workaround needs its own written controls.
Contract and insurance notice (owner: general counsel). Notify the cyber insurer promptly under the policy's notice conditions, send the contractual notice to RateCore, preserve privilege on the forensic work, and engage outside breach counsel.
Regulatory analysis (owner: compliance). Start the multi-state breach assessment now, even before scope is final.
Partner communication (owner: CEO with counsel). The delegating carrier gets a written update in 48 hours covering impact, controls, and remediation timeline; failing to deliver that is a contractual and relationship risk independent of the breach itself.
Evidence preservation. Instruct RateCore in writing to preserve logs and images; a vendor that restores over evidence can destroy the carrier's ability to investigate.
2. Resolve the dispute between the CEO and general counsel on customer notice. What is the right sequencing?
Read the worked answer
Both are partly right, and the framing as notice-now versus notice-later is a false choice. The right sequence is: start the analysis and the drafting now, set a decision date, and notify when the statutory trigger is met rather than when the forensic report is complete.
Breach statutes generally trigger on unauthorized acquisition plus a risk of harm, not on a completed root-cause analysis. Driver's license images are among the highest-risk data elements because they support identity theft and synthetic account opening. Waiting for a forensic report that may take four to six weeks risks blowing notification deadlines, and late notice after a known exposure reads as concealment to regulators and plaintiffs.
Recommended sequencing:
Days 1-3: Outside counsel and forensics engaged; written demand to RateCore for data-category confirmation; notify the cyber insurer; draft notification templates and a call-center script; notify the delegating carrier.
Days 3-5: If RateCore confirms license images and applications were in the encrypted store, notice affected individuals. The notice should state what is known, what is not known, what the carrier is doing, and what the individual should do. Do not speculate and do not blame the vendor.
In parallel: notify state regulators and attorneys general as each state's timing requires; issue a supplemental notice if scope expands.
The GC's caution belongs in the content and the wording, not in the timing.
3. What vendor-risk and contractual remediation should follow, and what does Harbor Point owe the delegating carrier?
Read the worked answer
Contractual. Negotiate a security exhibit: encryption standards at rest and in transit, multi-factor access control, network segmentation, annual penetration testing and SOC 2 Type II delivery, a 24-72 hour breach notification obligation to Harbor Point, subprocessor approval, audit rights, return and destruction of data, and a tested exit plan with data extraction in a usable format. Replace the $50,000 cap with liability tied to revenue and to breach costs, add cyber liability insurance naming Harbor Point as an additional insured, and add service credits that escalate.
Operational. Add vendor-hosted scenarios to the incident response plan and run a tabletop that includes manual binding. Tier vendors and add a concentration-risk view: a single rating platform hosting most of the book is a single point of failure. Require annual business continuity evidence and a restoration test, not a promise.
What is owed to the delegating carrier. The MGA is a licensee-equivalent for much of this work and cannot outsource its regulatory obligations. The written update should disclose the outage, the manual controls in place to protect binder authority, the data categories potentially exposed, the notification approach, and the remediation plan with dates. Expect the carrier to demand audit rights and possibly a suspension of new binding until controls are demonstrated. Cooperate fully; concealing the scope to protect the relationship is the higher-risk path, because the carrier bears the paper and will learn the facts from its own regulators.