Insider threat
Harm caused by someone with legitimate access to the systems, an employee or contractor, which puts the incident between the cyber and the crime policy.
In May 2025, Coinbase disclosed that customer support agents working overseas had been bribed to pass customer data to criminals, who then used it to scam those same customers by posing as the exchange. The attackers demanded $20 million to stay quiet; Coinbase refused and estimated the cost of the affair at $180 million to $400 million. An insider threat is harm caused by a person with legitimate access: an employee, a temp, a contractor, a former employee whose account is still live. Bribed, resentful or simply greedy, the insider needs no vulnerability, and controls built against outside intruders have trouble spotting him, since he opens the screens he is allowed to open. For the insurer, the claim plays out on the border between two policies. The cyber policy picks up the data breach, notification, response costs and liability to the people affected; the crime policy, or employee dishonesty cover, picks up theft of money or property by an employee. One incident can trigger both, or fall between them. Then there is the intentional acts exclusion. Written against the insured itself, it should not apply to the act of a lone employee (the rogue employee) unknown to management, and many cyber forms say so explicitly. The reading gets harder when the wrongdoer is an officer, whose intent can be imputed to the company. Not to be confused with non-malicious human error: the employee who sends a file to the wrong recipient causes a breach without intent. That breach is handled differently, in the policy and in the statistics.
Real case: in May 2025, Coinbase went public with the extortion attempt. Support agents working outside the United States, paid by the attackers, had copied customer data from internal tools, and the criminals then called those customers posing as Coinbase to get them to move their funds. The company refused the $20 million ransom and put the cost at $180 million to $400 million. For an insurer, the file raises every question at once: a data breach under the cyber policy, an employee's act under a crime policy, and voluntary customer reimbursements that neither one necessarily picks up.
insider threat, rogue employee, malicious insider, insider risk, bribed insider
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.