In April 2022, International Control Services, a manufacturer in Decatur, Illinois, bought a $1 million cyber insurance policy. On the application, it said it used multi-factor authentication to protect its administrative accounts. A month later, ransomware hit. When the insurer investigated, it found MFA on the company's firewall but not on the server the attackers walked through. The company ultimately agreed to have the policy rescinded. Void from the start. As if the coverage had never existed.
