Behind the Breach

It’s Friday afternoon at a beachfront hotel in North Carolina when ransomware brings check-in to a halt. Guests are waiting, staff are scrambling, and the attackers want $400,000. They also claim to have stolen guest information – and send a sample as proof.

Host Amber Wuollet is joined by Michele Lepper, Head of Claims Advocacy at CRC Group, to follow this fictionalized incident from the first call to the insurer through the decisions and costs that follow.

Through the lens of a claims advocate, Michele explains:

• Who handles ransom negotiations and who makes the payment decision.
• Why a usable backup doesn’t mean an immediate return to business.
• How insurer approval and payment arrangements can affect the response.
• What businesses need to document while keeping customers served.
• Why the insurance claim continues after systems are restored.

When decisions need to happen quickly, how do you keep the business moving while making sense of the insurance response?

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident and what organizations can learn before one happens to them.

This episode features a fictionalized scenario and is for informational purposes only. It does not constitute legal, insurance, or cybersecurity advice.

Orders are missing. Customers are asking questions. Online rumors begin spreading before the company fully understands what has happened.

Then investigators confirm ransomware.

In this episode of Behind the Breach, host Amber Wuollet follows a fictionalized ransomware scenario involving a major retailer as an internal incident becomes increasingly public. Employee and customer data is released online. Frontline employees are expected to answer questions while dealing with the exposure of their own personal information. Then the company’s private negotiation with the threat actor is leaked to the press.

She’s joined by Callum Laidlaw, Partner at Kekst CNC, to walk through the communications challenges that emerge over the following months—from early customer speculation and regulatory communications to data exposure, customer notifications, leaked negotiations, and the unexpected arrival of law enforcement.

Together, they explore how organizations can communicate under pressure without moving ahead of the facts, support employees who are both responders and victims, and maintain trust as new developments repeatedly bring the incident into public view.

In this episode:

• What organizations should be monitoring before a crisis begins
• Why communicating too quickly can create additional problems
• How communications teams work alongside legal counsel and regulators
• What customer-facing employees need to respond clearly and consistently
• How to support employees when their personal data is exposed
• How to respond when a private ransom negotiation is leaked
• Why organizations may be judged less for experiencing a cyber incident than for how they handle it

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident—and what organizations can learn before one happens to them.

Guest: Callum Laidlaw, Partner, Kekst CNC

Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell

Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.

A locked account. A routine help desk call. A password reset that appeared to follow the process.

Then $24 million in insurance payments went to the wrong account.

In this episode of Behind the Breach, host Amber Wuollet follows an anonymized healthcare scenario involving a large organization where a threat actor gains access through a help desk call, moves through internal systems, and changes payment information inside an insurance portal.

She’s joined by DJ Hoeksema, Head of Managed Security Services at SpearTip, a Zurich company, to walk through how the incident unfolded — from the initial password reset, to the payment diversion, to the investigation that followed.

Together, they explore why identity-based attacks can be difficult to detect, how attackers take advantage of trusted workflows, and what organizations can learn from a case where each individual step appeared routine until the financial impact became impossible to ignore.

In this episode:

• Why social engineering is effective against help desk workflows
• How exposed personal information can weaken identity verification
• What threat actors look for once they gain access to an account
• Why changes inside business portals can be difficult to detect
• How delayed discovery can make fund recovery harder
• What incident responders look for when reconstructing the timeline
• How organizations can strengthen help desk processes after an incident

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident — and what organizations can learn before one happens to them.

Guest: DJ Hoeksema, Head of Managed Security Services, SpearTip, a Zurich company

Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell

Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.

The week before Christmas is the busiest time of year for BrightSpark Toys. Orders are moving, warehouses are running around the clock, and every delay carries a cost.

Then systems start going down.

In this episode of Behind the Breach, host Amber Wuollet follows a fictionalized ransomware scenario involving a mid-sized toy manufacturer and distributor during its peak holiday season. She’s joined by Dominik Cvitanovic, breach counsel and attorney at Wilson Elser, to walk through the first seven days of the incident — from the first signs of trouble, to ransomware confirmation, attacker communication, legal considerations, and the pressure of restoring operations under uncertainty.

Together, they explore what happens when a ransom note appears, data may be at risk, and the threat actor suddenly goes silent mid-negotiation.

In this episode:

• Why incident response planning matters before systems go offline
• How cyber insurance can help connect organizations with expert support
• Why ransomware response involves legal, financial, operational, and reputational decisions
• What organizations should consider before engaging with a threat actor
• Why the first week can shape the direction of the response

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident — and what organizations can learn before one happens to them.

Guest: Dominik Cvitanovic, Attorney at Law, Wilson Elser

Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell

Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.

When a ransomware attack hits, the first 24 hours shape how an organization responds.

In this episode of Behind the Breach, we walk through a simulated cyber incident in real time — following a fictional company from initial detection through containment, investigation, and the path toward stability.

Joined by Cowbell’s Resiliency Services leaders, Matthieu Chan Tsin and Joe Hoosech, this episode explores what actually happens inside an organization during a breach — not in theory, but in practice.

You’ll hear:

• What the earliest signs of an attack look like
• How teams move from detection to containment
• The role of incident response planning in the first hours
• How forensic investigations begin
• What stability looks like after the initial disruption

This is a narrative walkthrough designed to help brokers and business leaders better understand how cyber incidents unfold — and how response takes shape in real time.

Behind the Breach is a Cowbell podcast exploring what happens inside a cyber incident — and what organizations can learn before one happens to them.

Guest: Matthieu Chan Tsin, Head of Resiliency Services, Cowbell, and Joe Hoosech, Principal, Cowbell Resiliency Services–Incident Response

Host: Amber Wuollet, Director of Product & Lifecycle Marketing, Cowbell

Disclaimer: This episode is for informational purposes only and does not constitute legal, insurance, or cybersecurity advice.