IT Forensics · Insurance
How can an insurance company arrange for a check to be carried out to determine whether an alleged data breach is technically verifiable?
If a policyholder reports a data breach following a cyber attack, the insurer needs reliable answers: Was data actually stolen? Which data, when and to what extent? And do the details match the technical sequence of events surrounding the incident?
Why this question is important for an insurance company
In disputed or financially significant claims, minor technical details can have a major impact on the assessment. This is precisely why a clear distinction must be drawn between an actual digital anomaly, its possible cause and a legal conclusion.
Technical background
Exfiltration leaves traces in network and firewall logs (unusual volumes of data being sent to external destinations), in the attackers’ tools (e.g. Rclone configurations, archiving programmes) and in cloud logs. In the case of ransomware groups, a publication on leak sites may be an indication – but it does not automatically confirm the scope and content.
Relevant evidence and data sources
- Firewall, proxy and NetFlow data, including volume and destinations
- Traces of exfiltration and archiving tools
- Cloud audit logs (downloads, shares)
- Public disclosure of leaked information (documented; not downloaded without a legal basis)
Borders
- If network logs are missing, a data leak is often neither verifiable nor rule out.
- The insurer decides on the cover.
Possible results
- Outflow technically verified (extent, time period)
- No discharge detected, but it cannot be ruled out
- Discrepancies between the report and the available data
Why LanCologne?
When carrying out a plausibility or tampering check, it is particularly important to adopt an unbiased approach. An unusual timestamp, a deleted file, an edited photograph or a gap in the log must not be interpreted as evidence of deception simply because the finding arises in a disputed insurance claim.
Here’s how we do it
- Recording of the claim notification and the alleged categories of data.
- Review of the available technical documentation and timelines.
- Plausibility assessment with outstanding issues.
No jumping to conclusions – even in the case of abnormal findings
Our task is not to confirm a suspicion. If a standard technical explanation is confirmed, it is documented. If a credible contradiction arises, this is also documented. If several explanations remain possible, the uncertainty is not replaced by a conjecture.
Transparent for the claims department and legal team – reproducible for forensic experts
The key message is formulated in a clear and understandable manner. The technical section includes the key data sources, time references, integrity information, artefact locations and validation steps. This ensures that the derivation remains verifiable for subsequent cross-checking.
LanCologne for independent technical plausibility checks
Where information, files, photographs, logs or other digital traces relating to an insurance claim require technical verification, LanCologne examines the specific technical issue in a non-prejudicial and transparent manner. The sole determining factor is what the lawfully available data actually demonstrates.
Legal framework
Section 31 of the German Insurance Contract Act (VVG) remains a key starting point for the assessment of claims: following the occurrence of an insured event, the insurer may request the information necessary to determine the insured event or the extent of its obligation to pay benefits; supporting documents may only be requested insofar as the policyholder can reasonably be expected to provide them. This does not imply a general right to a comprehensive forensic examination of all private data.
Section 28 of the Insurance Contract Act (VVG) governs the possible legal consequences of a breach of contractual obligations. Whether an obligation existed, whether it was breached, and what legal consequences ensue depend on the specific contract and the statutory requirements. A digital forensics report should therefore not conclude that there is no liability to perform, but should solely document the underlying technical facts.
With regard to personal data, particular attention must be paid to the principles set out in Article 5 of the GDPR – including purpose limitation and data minimisation – as well as to a legal basis in accordance with Article 6 of the GDPR. Data sources that are particularly intrusive must not be analysed comprehensively simply because they are technically available.
Should civil proceedings arise at a later date, it is for the court to assess the factual allegations. Section 286 of the Code of Civil Procedure (ZPO) governs the free assessment of evidence. Section 287 of the ZPO contains specific rules for determining the existence of damage and the extent thereof. The private expert report provides a technical factual basis for this, but does not replace the court’s assessment of the evidence.
Frequently Asked Questions
LanCologne – IT Forensics for Insurance Companies
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.
Related to this topic
- How can the plausibility of the size of an alleged digital data set be verified prior to the damage occurring?
- How can an insurance company have the alleged sequence of events leading to the claim objectively verified using digital evidence?
- How can the time of an insured event be reconstructed digitally?
- How can it be verified whether a computer or Server was actually in operation at the time the damage is said to have occurred?