Third-party claims after a data breach: does cyber insurance pay?

• AXA

  SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»)

  covered

  Condition and source: AXA

  Third-party claims arising from data loss, data protection breaches, confidential data; including defence. USA/Canada excluded.

  AXA Versicherungen AG, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A2.1, S. 7 · Open document (new window)

• Sunrise (AXA)

  Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others)

  limited Sublimit CHF 200'000

  Condition and source: Sunrise (AXA)

  As AXA, but only up to CHF 200'000 per claim.

  Sunrise GmbH, abgerufen 06.11.2026, S. 1, Leistungen · Open document (new window)

• Mobiliar

  Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection)

  covered

  Condition and source: Mobiliar

  Financial losses of third parties arising from breaches of data protection/confidentiality and breaches of network security, also in the case of human error.

  Schweizerische Mobiliar Versicherungsgesellschaft AG, Ausgabe 01.2024, Ziff. C1, S. 18 · Open document (new window)

• Zurich

  Zurich Cyberversicherung (variants Basic, Optimum, Premium)

  covered

  Condition and source: Zurich

  Data protection breaches (including unintentional disclosure), transmission of malware, DoS against third parties; defence included.

  Zürich Versicherungs-Gesellschaft AG, Ausgabe 01/2024 (ZH9513d-2402), Art. 203, S. 9 · Open document (new window)

• Helvetia

  Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP)

  covered

  Condition and source: Helvetia

  Pure financial losses including non-material damage, defence against unfounded claims; liability sum insured CHF 500'000 or 1 million.

  Helvetia Schweizerische Versicherungsgesellschaft AG, Ausgabe Juni 2026 (Dokument 01.07.2026, CH00TLV), Ziff. 3.3.2.1, S. 12 · Open document (new window)

• Allianz Suisse

  Cyber Risk Versicherung

  unclear

  Condition and source: Allianz Suisse

  According to the product page, data protection and data loss liability.

  Terms not public, quote via BTAG.

  Allianz Suisse Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document (new window)

• Vaudoise

  Additional cover «Cyber and data protection» to the Business One contents and business liability insurance

  unclear

  Condition and source: Vaudoise

  Only advertising text from the product page (data restoration, notification, reputation, extortion «and if necessary the payment of a ransom», business interruption, liability); cyber GTC not public.

  Terms not public, quote via BTAG.

  Vaudoise Allgemeine Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document (new window)

• Chubb

  Cyber Enterprise Risk Management (Cyber ERM) V2.2

  covered

  Condition and source: Chubb

  Privacy and Network Security Liability.

  Terms not public, quote via BTAG.

  Chubb European Group SE, 01/2022, 1.5 · Open document (new window)

• AIG

  CyberEdge

  covered

  Condition and source: AIG

  According to the product page, liability towards third parties.

  Terms not public, quote via BTAG.

  AIG Europe S.A., Zweigniederlassung Opfikon, geändert 20.08.2026 · Open document (new window)

6 insurers without a business product we read

• Baloise: No more new business under Baloise. The cyber pages of baloise.ch redirect to the Helvetia Cyber-Versicherung; existing contracts continue with Helvetia. Baloise cyber GTC no longer public.
  Where does it say so?

  Helvetia und Baloise sind jetzt eins (FAQ Zusammenschluss), abgerufen 06.11.2026, FAQ Neugeschäft

  «Neue Verträge werden immer im Namen von Helvetia ausgestellt.»

  Open document: Helvetia und Baloise sind jetzt eins (FAQ Zusammenschluss) (opens in a new window), retrieved 06.11.2026

• Generali: No cyber insurance for companies found (private customers only). For companies there is «internet legal protection» as a module of business legal protection (up to CHF 100'000 Switzerland / 50'000 worldwide, without deductible). This is legal protection, not cyber insurance.
  Where does it say so?

  Internetrechtsschutz für Unternehmen (Produktseite), abgerufen 06.11.2026

  «Deckung bis CHF 100'000 in der Schweiz»

  Open document: Internetrechtsschutz für Unternehmen (Produktseite) (opens in a new window), retrieved 06.11.2026

• Liberty: Cyber risks are underwritten (underwriters in Zürich); product page and GTC (according to VZ «Cyber Risk Versicherung 2015-09») not public. The 2015 edition is older than today’s war and infrastructure clauses.
  Where does it say so?

  Facts & Contacts Schweiz, 07/2022

  Open document: Facts & Contacts Schweiz (opens in a new window), retrieved 06.11.2026

• Hiscox: No offer found in Switzerland: country list without Switzerland; hiscox.de conditions apply only to Germany/Austria.
  Where does it say so?

  Hiscox in your country (Länderliste), abgerufen 06.11.2026

  Open document: Hiscox in your country (Länderliste) (opens in a new window), retrieved 06.11.2026

• smile: No cyber insurance for companies (products: car, household, motorcycle, travel, legal protection, death).
  Where does it say so?

  smile Produktübersicht, abgerufen 06.11.2026

  Open document: smile Produktübersicht (opens in a new window), retrieved 06.11.2026

• Simpego: No cyber insurance for companies found.
  Where does it say so?

  Simpego Produktübersicht, abgerufen 06.11.2026

  Open document: Simpego Produktübersicht (opens in a new window), retrieved 06.11.2026

In 25 scenarios from 17 industries, a cost item concerns this module.

All scenarios with this module

• Butcher’s shop
  • Customer data stolen from the party catering shop covered
• Restaurant and catering
  • Guest data leaked at the reservation provider covered
• Hotel and accommodation
  • Booking account taken over, guests cheated out of deposits unclear
  • Booking data stolen from a software provider covered
• Trades (electrical, plumbing, joinery, painting)
  • Hacked email account: customer pays invoice into the wrong account unclear
• Construction company
  • Plans of a sensitive building on the darknet covered
• Garage and car dealership
  • Customer pays fraudsters for a used car unclear
• Medical practice
  • Patient data encrypted and published covered
  • Attack on the practice’s IT service provider covered
  • Test results sent to the wrong email address limited
• Physiotherapy
  • Report sent to the wrong health insurer limited
• Pharmacy and drugstore
  • Health data from the online shop covered
• Fiduciary services
  • Fake president with a cloned voice unclear
  • Client data stolen, publication threatened covered
  • IT outage during the tax deadline unclear
• Law firm and notary’s office
  • Client data on the darknet covered
  • Encrypted files, missed deadline unclear
  • Legal brief sent to the wrong party limited
• Architectural and engineering office
  • Plans encrypted, construction site waiting covered
• Retail (shop)
  • Break-in via the air conditioning technician’s access covered
• Online shop
  • Card data stolen in the shop (skimming) covered
• Transport and logistics
  • Dispatching encrypted, lorries at a standstill not covered
• Production and industrial SMEs
  • ERP encrypted, production at a standstill for a month not covered
• IT service provider and software company
  • All customers encrypted via remote maintenance unclear
  • Own faulty update paralyses customers not covered

The other 16 modules

• Immediate help in an emergency
• Restore data and systems
• Replace unusable devices
• Loss of income after an attack
• Outage at the IT provider
• Outage due to operating error
• Cyber extortion
• Proceedings before authorities
• Inform affected people
• Fraud with fake instructions
• Hacked e-banking
• Phone hacking and extra costs
• Property damage caused by an attack
• Reputational damage
• Card industry penalties
• Media liability