Cyber insurance hotline information gathering

Overview

First insurer call sets duty to defend path—collect before dialing when possible; counsel often joins.

Facts to assemble

• Discovery date/time (best estimate) and current status (contained / active).
• Systems/data classes implicated; rough record counts if known—no guessing PHI.
• Notifications started (regulators, individuals) or pending legal advice.
• Forensics firm engaged or planned; law enforcement report status.
• Prior similar events (honesty matters for coverage).

Documents handy

Policy number, declarations, application answers (consistency with truth).

What insurers ask

Ransom demands received; extortion channel; backup availability; public attention likelihood.

Pitfalls

Admitting unrelated prior unreported incidents casually—counsel filters phrasing.

Follow-up

Preserve call reference number; log who spoke; submit written proof of loss per deadlines.

Internal

Finance + legal approve vendor payments above sub-limits—know retention dollar.

Client MSPs

Coach insured to loop you on technical affidavits needed—timeline integrity.