A professional services firm in the Greater Toronto Area had operated for 14 years, growing from a small consultancy to an organization with 85 employees across 3 office locations. The firm held client files containing sensitive personal and financial information for approximately 2,400 active accounts, maintained a proprietary client management database, and processed electronic payments through an integrated billing system. The managing partners had carried a basic commercial general liability policy since the firm's founding but had never purchased standalone cyber coverage, relying instead on a technology errors and omissions endorsement added to their professional liability policy 6 years earlier.

In early spring, the firm's IT contractor conducted a security assessment and identified several vulnerabilities in the network architecture, including outdated firewall configurations, inconsistent multi-factor authentication across employee accounts, and a backup system that had not been tested for restoration capability in over 18 months. The contractor recommended immediate remediation and suggested the partners consult their insurance broker about cyber liability coverage. The broker obtained preliminary quotes from 3 insurers, but the application process revealed gaps in the firm's security posture that complicated the underwriting assessment. One insurer declined to quote entirely. A second offered coverage with substantial sublimits and a $75,000 retention. The third requested additional documentation regarding the firm's incident response plan, employee security training protocols, and vendor management practices — documentation the firm did not possess.

While the partners debated whether to invest in security improvements before binding coverage or to accept the limited terms available, the firm's network administrator detected unusual activity in the client database system during a routine Monday morning review. Log files showed unauthorized access attempts originating from an unfamiliar IP address over the preceding weekend. The administrator could not immediately determine whether data had been exfiltrated, whether the intrusion was ongoing, or whether client notification obligations had been triggered under federal or provincial privacy legislation. The firm had no formal incident response plan, no pre-arranged relationship with forensic investigators or breach counsel, and an unresolved question about whether any existing insurance coverage would respond to investigation and remediation costs. The managing partners faced immediate decisions about containment, notification, regulatory compliance, and claim reporting, with uncertainty about their obligations under any coverage that might apply and the consequences of missteps in the critical early hours of a potential breach.