Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Law firm and notary’s office: what can happen, and who pays?

limited 7 of 13 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Legal brief sent to the wrong party” (likelihood high).

As of

Law firm5. Fake client by video51. Legal brief sent to the wrong party13. Encrypted files, missed deadline3034. Client funds into the wrong account42. Client data on the darknet2

Fake client by video

Legal brief sent to the wrong party

Encrypted files, missed deadline

Client funds into the wrong account

Client data on the darknet

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Legal brief sent to the wrong party
  2. Client data on the darknet
  3. Encrypted files, missed deadline
  4. Client funds into the wrong account
  5. Fake client by video

1Legal brief sent to the wrong party

Receipt

Law firm and notary’s office

Tap a line for the reasoning

  • Clarification and loss mitigation CHF 1'200–5'200 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–15 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Claims by the client no reliable figure limited

    Zurich covers unintentional disclosure; otherwise professional liability. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 1'200–5'200
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood high

A legal brief containing the client’s health data is sent by email to the opposing party instead of the court.

How it unfolds

Entry point: Operating error

What AI changes: No direct AI connection.

Why high? Everyday mistake.

What prevents it

  • Check the recipient before sending.
  • Secure delivery platforms.
  • Address autocomplete off.
Pitfalls in the terms
  • Operating errors without an attack: AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover negligent errors by staff.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. E2, S. 16

    «Ein Cyber-Eigenschaden-Ereignis ist ein vorsätzlicher, schädigender Angriff durch Dritte oder durch versicherte Personen»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Third-party claims after a data breach

2Client data on the darknet

Receipt

Law firm and notary’s office

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • External lawyers: data protection, professional secrecy, defence CHF 5'000–21'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–60 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of clients by letter (postage only) CHF 500–6'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 500–5'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Claims by clients no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No amounts found.

  • Ransom no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Not recommended.

Usually paid by the cyber policy
CHF 10'500–59'000, plus 1 item without an amount
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood medium

A ransomware group steals contracts, correspondence and court files and publishes parts of them to extort the law firm. Clients demand information and threaten to claim damages.

How it unfolds

Entry point: Ransomware with data theft

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Documented at a US law firm (Grubman, 2020); lawyers hold particularly sensitive data.

What prevents it

  • Files encrypted, access according to mandate.
  • Two-factor login.
  • Offline backup.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach, Cyber extortion

3Encrypted files, missed deadline

Receipt

Law firm and notary’s office

Tap a line for the reasoning

  • Loss of revenue CHF 5'000–11'700 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 3–7 days × around CHF 3'340 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–11'200 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–50 h × CHF 180–225/h (IT support for SMEs, office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–400/h (market range for incident response)

  • Liability for a missed deadline no reliable figure unclear

    More a matter for professional liability; cyber liability covers data protection and network breaches. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 6'100–23'200
Open or only with an add-on
CHF 5'000–11'700, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

Ransomware paralyses the law firm for a week; a deadline for an appeal is missed.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Ransomware outages of several days are typical.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Deadlines kept redundantly (paper or a second system).
  • Emergency access to court platforms.
  • Coordinate professional liability and cyber liability.
Pitfalls in the terms

Modules: Loss of income after an attack, Restore data and systems, Immediate help in an emergency, Third-party claims after a data breach

4Client funds into the wrong account

Receipt

Law firm and notary’s office

Tap a line for the reasoning

  • Client funds transferred CHF 100'000–1'500'000 add-on

    Sub-limits (Helvetia max. CHF 100'000) hardly cover such amounts; entrusted funds only at Zurich with liability. How we got there: Assumption; NCSC: largest individual loss from invoice manipulation mentioned CHF 1.5 million.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 100'000–1'500'000
Usually stays with the business
nothing

Likelihood low

During a property purchase, the supposed counterparty sends new bank details. The law firm transfers the purchase price of CHF 400'000 from the client money account.

How it unfolds

Entry point: Hacked email account of the counterparty

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Large amounts, but strict procedures at notary’s offices; according to the NCSC, individual cases with losses in the millions.

Where does it say so?

Halbjahresbericht 2025/II (Juli–Dezember), 30.03.2026

Open document: Halbjahresbericht 2025/II (Juli–Dezember) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Bank details for transactions only in writing with a signature and a call-back.
  • Second approval for client funds.
  • Use name matching with the bank (IBAN name check) where available.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

5Fake client by video

Receipt

Law firm and notary’s office

Tap a line for the reasoning

  • Funds passed on CHF 50'000–500'000 not covered

    Video/telephone: Helvetia excluded, Zurich/Mobiliar only written online orders; AXA A6 with add-on. How we got there: Assumption.

Usually stays with the businessCHF 50'000–500'000

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood low

A supposed entrepreneur gives instructions by video conference and demands the transfer of deposited funds; image and voice are fake.

How it unfolds

Entry point: Deepfake video conference

What AI changes: Real-time deepfakes of image and voice are possible with freely available tools.

Why low? Documented at Arup (Hong Kong, around USD 25 million) and as an attempt in Switzerland (2024).

What prevents it

  • Verify the identity of new clients independently (ID, commercial register, call-back).
  • No payments on the basis of video instructions.
  • Code word with important clients.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 3'340 Average revenue per day; your business may be smaller.

CHF 700–1'600 Annual premium for a micro business, indicative value based on the Helvetia rate, group C, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: good.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group C (among others, retail, food production, metal goods, doctors, lawyers); this assignment is ours, not the insurer’s.

Indicative premiums for Law firm and notary’s office per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 700–1'600Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote. Butcher’s shop is not named literally in the application; Group C via «retail» and «manufacture of food».

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 1'100–2'800Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

  • Law firm software with files and deadlines
  • Email with clients and courts, secure platforms
  • Client money and escrow accounts in e-banking
  • Video conferences Comparison: deepfake video conference at Arup. Documented case: Arup (Hong Kong office)

Real cases

  • Switzerland · 10.2025

    Around 200 companies in Switzerland (anonymous)

    Between May 2023 and September 2025, the Akira group attacked around 200 companies in Switzerland with ransomware, most recently four to five cases a week.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 04.2024

    Company (anonymous)

    A supposed lawyer called a company’s finance manager and invited him to a video conference with his boss.

3 more cases and sample cases

Three ways forward