Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Pharmacy and drugstore: what can happen, and who pays?

limited 7 of 11 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Pharmacy software encrypted on Friday afternoon” (likelihood medium).

As of

Pharmacy and drugstore1. Pharmacy software encrypted on Friday afternoon14. Health data from the online shop43. Temperature in the medicine refrigerator changed32. CEO email to the branch management25. Wholesaler’s ordering portal down5

Pharmacy software encrypted on Friday afternoon

Health data from the online shop

Temperature in the medicine refrigerator changed

CEO email to the branch management

Wholesaler’s ordering portal down

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Pharmacy software encrypted on Friday afternoon
  2. CEO email to the branch management
  3. Temperature in the medicine refrigerator changed
  4. Health data from the online shop
  5. Wholesaler’s ordering portal down

1Pharmacy software encrypted on Friday afternoon

Receipt

Pharmacy and drugstore

Tap a line for the reasoning

  • IT service provider: clean-up, rebuild, restoring the backup CHF 2'200–6'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 8–20 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'200–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–400/h (market range for incident response)

  • Loss of revenue CHF 10'400–26'000 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 1–2.5 days × around CHF 20'800 revenue/day × 50% (assumption: partial sales by hand) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 3'400–14'800
Open or only with an add-on
CHF 10'400–26'000
Usually stays with the business
nothing

Likelihood medium

On Friday afternoon, ransomware encrypts the pharmacy software. Nothing can be sold or ordered from the wholesaler; prescriptions are noted by hand.

How it unfolds

Only on Monday does the technician restore the system.

Entry point: Probably an email attachment

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Documented German case (outage of around 2.5 days); no public Swiss case.

What prevents it

  • Emergency process for dispensing prescriptions without the system.
  • Test offline backup and restoration with the software provider.
  • Open email attachments only on the isolated office PC.
Pitfalls in the terms
  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Restore data and systems, Immediate help in an emergency, Loss of income after an attack

2CEO email to the branch management

Receipt

Pharmacy and drugstore

Tap a line for the reasoning

  • Amount transferred CHF 5'000–50'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 5'000–50'000
Usually stays with the business
nothing

Likelihood medium

The branch manager of a pharmacy chain receives an email from the owner asking her to pay an urgent supplier invoice of CHF 40'000.

How it unfolds

Entry point: Fake sender address

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? NCSC: 970 reports of CEO fraud in 2025.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Never make payments on instructions by email.
  • Call back.
  • Four-eyes principle.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

3Temperature in the medicine refrigerator changed

Receipt

Pharmacy and drugstore

Tap a line for the reasoning

  • Unusable medicines CHF 2'000–30'000 not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Assumption: contents of one or two medicine refrigerators; not documented.

  • Reset the monitoring CHF 360–1'400 covered

    Control system = IT system. How we got there: 2–6 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually stays with the businessCHF 2'000–30'000

Usually paid by the cyber policy
CHF 360–1'400
Open or only with an add-on
nothing

Likelihood low

Via the networked temperature monitoring, the alarm is switched off and the target temperature raised. Vaccines and insulins can no longer be used.

How it unfolds

Entry point: Networked refrigeration or monitoring system

What AI changes: As with the butcher’s shop.

Why low? Wave of attacks on refrigeration in retail documented from October 2026; no case known for pharmacies.

Where does it say so?

CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

«Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

What prevents it

  • Independent data logger with its own alarm.
  • Monitoring not directly on the internet.
  • Check the cover for refrigerated goods in the property insurance.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Property insurance usually does not help: refrigerated goods are insured there only as an add-on and only in the event of a technical defect or power interruption (AXA property B8, Allianz C6.3.3); AXA excludes operating errors (B8.5) and, in the catch-all provision, hacker attacks (let. s), Mobiliar All Risks excludes cyber risks (section 3).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung, Ausgabe 06.2024 (16373DE – 2024-06), Nicht genannte Gefahren, lit. s

    «Schäden verursacht durch Schadprogramme, Hacker- und Denial-of-Service-Angriffe sowie andere Cyber-Ereignisse.»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung (opens in a new window), retrieved 06.11.2026

Modules: Property damage caused by an attack, Restore data and systems

4Health data from the online shop

Receipt

Pharmacy and drugstore

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'000–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 8–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 1'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Compensation for non-material damage and damages no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 5'500–34'500, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood low

Orders of prescription medicines leak from the online shop. The order allows conclusions to be drawn about illnesses.

How it unfolds

Customers are extorted with sextortion-like emails.

Entry point: Vulnerability in the shop

What AI changes: AI makes it easier to evaluate the orders and to write extortion emails.

Why low? No Swiss pharmacy case known; extortion of patients with health data documented (Vastaamo, Finland).

What prevents it

  • Minimise and encrypt health data in the shop.
  • Shop platform with security certification.
  • Regular security testing.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach

5Wholesaler’s ordering portal down

Receipt

Pharmacy and drugstore

Tap a line for the reasoning

  • Loss of revenue due to missing goods CHF 4'200–6'200 not covered

    The outage of a supplier (not an IT service provider of the business) is not an insured event; AXA excludes contingent losses from third-party businesses. How we got there: 2–3 days × around CHF 20'800 revenue/day × 10% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 4'200–6'200

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood low

The pharmaceutical wholesaler is attacked, and orders and deliveries are held up for three days. The pharmacy cannot reorder medicines.

How it unfolds

Entry point: Attack on the supplier

What AI changes: No direct AI connection.

Why low? No public Swiss case; supply chain attacks generally documented.

What prevents it

  • Agree a second supply channel.
  • Minimum stock of critical medicines.
  • Actively inform customers.
Pitfalls in the terms

Modules: Outage at the IT provider

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 20'800 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

  • Pharmacy software with till, stock and ordering from the wholesaler Documented case: Apotheke am Lindenbaum
  • Medicine refrigerators with temperature monitoring Assumption, no source on remote maintenance.
  • Electronic prescriptions, billing with health insurers
  • Online shop and ordering apps

Real cases

  • Switzerland · 01.2024

    Company (anonymous)

    Fraudsters posed as the boss to a company in Central Valais and demanded a large payment.

  • Germany · 06.2016Abroad: Germany

    Apotheke am Lindenbaum

    On a Friday afternoon, ransomware encrypted the pharmacy software despite antivirus protection and a firewall; the pharmacy could neither sell nor order medicines.

  • France · 10.2026Abroad: France

    Intermarché, Coopérative U, Carrefour (more than 230 branches)

    During the night before 12 October 2026, attackers switched the refrigeration and freezer systems of around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops to defrost mode; for around six hours the temperature rose to as much as 50 degrees.

2 more cases and sample cases

Three ways forward