MOVEit, one year on: what the tower actually paid
A zero-day in a file-transfer product became a $12B aggregate loss. We worked downstream of it. Here's what each layer of the tower actually responded to.
What happened
A vulnerability in MOVEit Transfer, a managed file-transfer product used by thousands of organisations, was exploited to exfiltrate data from downstream customers - banks, airlines, universities, and government agencies. The aggregate loss crossed USD $12B. The attacker didn't hit the end organisations directly; they hit the supply chain.
We worked with a downstream SaaS company whose data flowed through a MOVEit-using vendor. The company itself was never compromised. Its exposure was entirely contingent.
What first-party cyber paid
First-party cover paid the incident-response costs: forensics to confirm no direct compromise, breach counsel, and - the larger number - notification and credit monitoring for the customer records the vendor had leaked. Because the exposure was triggered downstream, the contingent business-interruption endorsement was what turned 'we lost a week of revenue' into 'the policy reimbursed it.'
Critically, without the supply-chain extension in the policy's definition of computer system, the contingent claims would have been denied. The endorsement wasn't the most expensive line on the schedule; it was the most important.
Reading is the start. A short conversation turns it into a plan.
No sales pressure. We'll look at your stage, your contracts, and your AI exposure, and tell you - plainly - where your current coverage won't hold up.
Risk notes, once a month.
One short note on Ontario tech risk - breaches, regulation, and what your policy should actually cover.
What third-party paid
Third-party cover defended the customer claims - the institutions whose data flowed through the SaaS company and now alleged the company should have caught the vendor breach sooner. Tech E&O carried most of this defence, because the failure framed as a failure of the company's vendor-security due-diligence is a professional-services claim.
The cyber third-party limit and the Tech E&O limit both eroded. The company learned, the hard way, why a shared 'tech package' limit is fragile: when a supply-chain event triggers both policies at once, a single shared limit is not double cover - it's half the cover it looks like.
Lessons for your tower
Three lessons. Keep cyber and Tech E&O as separate limits, not a shared package, if you sit in a supply chain. Insist on a contingent business-interruption endorsement with a supply-chain definition that names vendor and sub-processor breaches. And size each limit to the contingent exposure - the cost if your vendor fails - not only to your own.
If your product is itself the supply chain - an SDK, an API, a managed service - the same logic applies in reverse: your contingent-BI exposure is every customer at once. Move those limits up a step at every funding round.
Keep reading
Ransomware is changing in 2026 - and Ontario underwriters know it
Encryption is the old playbook. Extortion - the threat of leaking data, not locking it - is the new one. Here's what that means for your cyber limit.
PHIPA breach windows: what actually counts as 'prompt'
Ontario's IPC has tightened what 'prompt notification' means under PHIPA. The window is shorter than most healthtech founders think - and the fines are personal.
When your AI hallucinates, who pays?
The Air Canada chatbot case is now precedent Ontario tribunals cite. If you ship an LLM feature, your Tech E&O needs an AI endorsement - not a hope.
Keep exploring
General information only. Not insurance advice.