Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Architectural and engineering office: what can happen, and who pays?

limited 9 of 14 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Plans encrypted, construction site waiting” (likelihood medium).

As of

Architectural5. Calculation data changed unnoticed54. Deepfake video conference with the «CFO»43. Client pays fee to fraudsters31. Plans encrypted, construction site waiting12. Cloud storage configured to be open2

Calculation data changed unnoticed

Deepfake video conference with the «CFO»

Client pays fee to fraudsters

Plans encrypted, construction site waiting

Cloud storage configured to be open

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Plans encrypted, construction site waiting
  2. Cloud storage configured to be open
  3. Client pays fee to fraudsters
  4. Deepfake video conference with the «CFO»
  5. Calculation data changed unnoticed

1Plans encrypted, construction site waiting

Receipt

Architectural and engineering office

Tap a line for the reasoning

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–400/h (market range for incident response)

  • Manual reconstruction of plans CHF 5'000–30'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: Assumption: planners’ hours; not documented.

  • Claims by parties involved in the construction (standstill, loss of rent) CHF 10'000–100'000 covered

    Helvetia compensates justified claims and defends against unjustified ones; contractual penalties are excluded. How we got there: Assumption; Helvetia sample case without amounts.

  • Loss of revenue CHF 5'500–27'300 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 3–7 days × CHF 3'680–7'800 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 21'100–155'500
Open or only with an add-on
CHF 5'500–27'300
Usually stays with the business
nothing

Likelihood medium

Malware gets onto the server via an employee’s private USB stick and encrypts all data. Urgent plans for the site management do not arrive in time, and construction machinery stands idle.

How it unfolds

Several parties involved in the construction claim damages.

Entry point: Private USB stick or malware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Helvetia sample case; real cases at an interior design office in French-speaking Switzerland (RansomHub) and Zaha Hadid (London).

Where does it say so?

Broschüre Cyber-Versicherung, 07.26 (Nr. 120015329)

Open document: Broschüre Cyber-Versicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • Block USB sticks or allow only encrypted company sticks.
  • Versions of the plans also on the exchange platform.
  • Offline backup.
Pitfalls in the terms

Modules: Restore data and systems, Immediate help in an emergency, Third-party claims after a data breach, Loss of income after an attack

2Cloud storage configured to be open

Receipt

Architectural and engineering office

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–7'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 1'800–6'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 10–30 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
CHF 5'500–29'800
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood medium

A cloud storage with project data is accidentally publicly accessible. Attackers copy plans and customer data and delete the backups.

How it unfolds

Entry point: Misconfiguration

What AI changes: AI tools search open storage more quickly.

Why medium? NCSC: RansomHub deliberately targets poorly configured cloud storage.

What prevents it

  • Check shares regularly.
  • Immutable backups.
  • Cloud account with two-factor login.
Pitfalls in the terms
  • Operating errors without an attack: AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover negligent errors by staff.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. E2, S. 16

    «Ein Cyber-Eigenschaden-Ereignis ist ein vorsätzlicher, schädigender Angriff durch Dritte oder durch versicherte Personen»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems

3Client pays fee to fraudsters

Receipt

Architectural and engineering office

Tap a line for the reasoning

  • Outstanding fee CHF 5'000–50'000 not covered

    Only Helvetia 3.3.1.8 let. b. How we got there: Assumption.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually stays with the businessCHF 5'000–50'000

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
nothing

Likelihood medium

From the office’s hacked mailbox, a client receives a fee invoice with a new IBAN.

How it unfolds

Entry point: Hacked email account

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Invoice manipulation is widespread.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login.
  • IBAN notice.
  • Signed PDF invoices.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

4Deepfake video conference with the «CFO»

Receipt

Architectural and engineering office

Tap a line for the reasoning

  • Amounts transferred CHF 50'000–500'000 limited

    If the instruction came by email, the add-on may apply (Zurich, Mobiliar); Helvetia excludes payments triggered by video. How we got there: Assumption; Arup USD 25 million.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 50'000–500'000
Usually stays with the business
nothing

Likelihood low

After an email from the supposed CFO, an employee takes part in a video conference in which all the other participants are fake. She makes several transfers.

How it unfolds

Entry point: Email plus deepfake video conference

What AI changes: Real-time deepfakes of several people.

Why low? Documented at Arup (engineering, around USD 25 million).

What prevents it

  • Payments only via a defined process, never from a video call.
  • Call back.
  • Training with real examples.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

5Calculation data changed unnoticed

Receipt

Architectural and engineering office

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • Recalculation and checking CHF 5'000–40'000 limited

    Restoration of the data covered; additional work for recalculation depending on the insurer. How we got there: Assumption.

  • Consequences of an undetected error no reliable figure unclear

    Bodily injury and property damage are excluded under cyber insurance; check professional liability. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 2'500–16'000
Open or only with an add-on
CHF 5'000–40'000, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood low

An attacker with access to the server changes load assumptions in a structural analysis file. The error is only noticed during checking; plans have to be recalculated.

How it unfolds

Entry point: Unauthorised access

What AI changes: AI could make targeted, plausible changes easier; not documented.

Why low? No case known; integrity attacks are rare.

What prevents it

  • Versioning and checksums for calculation files.
  • Four-eyes check.
  • Access logs.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Property damage caused by an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 3'680–7'800 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: good.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 2024

    Interior design company from French-speaking Switzerland (anonymous)

    The NCSC counts an interior design company from French-speaking Switzerland among the at least three Swiss victims of the «RansomHub» ransomware that emerged in 2024.

  • Switzerland · 06.2022

    Garage (anonymous) and its customer

    A customer bought a used car from a garage and received the invoice for more than 18'000 francs by email.

  • United Kingdom · 04.2020Abroad: United Kingdom

    Zaha Hadid Architects

    On 21 April 2020, attackers encrypted part of the architectural office’s internal data and demanded a ransom; how much they exfiltrated was unclear.

2 more cases and sample cases

  • Hong Kong · 01.2024Abroad: Hong Kong

    Arup (Hong Kong office)

    An employee in Hong Kong received an email from the supposed CFO in London about a confidential transaction.

  • Sample case from an insurer: Helvetia

    Malware gets into the architectural office via an employee’s private USB stick and encrypts the server; urgently needed plans arrive too late, the construction site is delayed, and parties involved in the construction claim damages.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package».

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 7/9, «Haftpflichtansprüche aus Lieferverzögerungen»

    «Mehrere Baubeteiligte machen gegenüber dem Architekturbüro Forderungen (stillstehende Baumaschinen, Mietausfälle etc.) geltend.»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

Three ways forward