Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Bakery and confectionery: what can happen, and who pays?

limited 7 of 14 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. Since October 2026, attackers in several European countries have been manipulating refrigeration systems via the internet.

Who pays for spoiled goods after an attack

As of

Bakery and confectionery4. Proofer and freezer room changed via remote maintenance42. Ransomware paralyses all branch tills25. Price screens show propaganda51. Branch manager buys gift cards for the «boss»13. The software provider’s ordering portal fails3

Proofer and freezer room changed via remote maintenance

Ransomware paralyses all branch tills

Price screens show propaganda

Branch manager buys gift cards for the «boss»

The software provider’s ordering portal fails

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Branch manager buys gift cards for the «boss»
  2. Ransomware paralyses all branch tills
  3. The software provider’s ordering portal fails
  4. Proofer and freezer room changed via remote maintenance
  5. Price screens show propaganda

1Branch manager buys gift cards for the «boss»

Receipt

Bakery and confectionery

Tap a line for the reasoning

  • Gift cards purchased CHF 500–3'000 add-on

    Only with the add-on; in addition, often below the deductible (Helvetia deductible CHF 1'000). How we got there: Assumption: several hundred francs to a few thousand francs (NCSC: «often several hundred francs»).

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 500–3'000
Usually stays with the business
nothing

Likelihood high

On Friday afternoon, a branch manager receives an email from the supposed owner: he urgently needs online gift cards for customers, and she should send the codes by email. She buys cards for CHF 1'500 at the petrol station.

How it unfolds

The fraud only comes to light on Monday.

Entry point: Fake sender address with the owner’s name

What AI changes: AI adopts the owner’s writing style from the website and social media.

Why high? NCSC: 970 reports of CEO fraud in 2025; municipalities and associations reported exactly this gift card scam, and the amounts are often below internal limits.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Make the rule known: the boss never asks for gift cards or payments by email.
  • Always check back via the known mobile number.
  • Have external sender addresses flagged in the email program.
Pitfalls in the terms

Modules: Fraud with fake instructions

2Ransomware paralyses all branch tills

Receipt

Bakery and confectionery

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'000–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 8–30 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 4'000–16'900 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 15–50 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Resetting tills and office PCs CHF 1'100–12'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 6–15 devices × CHF 180–800 per device

  • Loss of revenue in the branches CHF 1'600–4'900 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 1–3 days × around CHF 3'250 revenue/day × 50% (assumption: cash sales continue) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 7'100–40'900
Open or only with an add-on
CHF 1'600–4'900
Usually stays with the business
nothing

Likelihood medium

An employee opens a supposed job application; malware spreads to the till server. On Saturday morning, the tills in six branches do not start.

How it unfolds

Sales are made with pocket calculators and only for cash, and resellers’ orders are lost.

Entry point: Email with a job application, followed by spread through the company network

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Documented at a German grocery shop (closed for several days) and at Coop Sweden via the till service provider; application emails are a common lure (Zurich fiduciary sample case).

What prevents it

  • Tills in their own network, separate from the office.
  • Open job applications only via a portal or as PDFs in an isolated mailbox.
  • Test the till’s offline mode with the provider.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Gross negligence (Art. 14 ICA): AXA (A13) and Helvetia (4.6.4) waive the reduction, Mobiliar and Zurich do not. The waiver does not help if an obligation (backup, patch, call-back) has been breached.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A13, S. 11

    «Die AXA verzichtet auf das Recht der Leistungskürzung»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack

3The software provider’s ordering portal fails

Receipt

Bakery and confectionery

Tap a line for the reasoning

  • Loss of revenue from major customers CHF 1'300–2'600 limited

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: 2–4 days × around CHF 3'250 revenue/day × 20% (assumption: share of portal orders) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Set up a workaround (order list, telephone) CHF 720–2'700 limited

    Additional costs to keep the business running; covered if the service provider outage is insured. How we got there: 4–12 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 2'020–5'300
Usually stays with the business
nothing

Likelihood medium

The bakery receives orders from restaurants, care homes and resellers via the online portal of a sector software provider. The provider is hit by ransomware; for four days, neither orders nor delivery notes can be accessed.

How it unfolds

The bakery phones customers and bakes according to the previous day’s quantities.

Entry point: Attack on the software provider (supply chain)

What AI changes: AI helps attackers to contact and extort many customers of a provider at the same time.

Why medium? Attacks on service providers with many customers have been documented several times in Switzerland (Xplain, Unico Data, Vétroz); Verizon: 48% of data breaches in 2026 involved third parties.

What prevents it

  • Contract with the provider: emergency process, data export, liability.
  • Back up an up-to-date order list locally every day.
  • Clarify with the insurer whether the provider counts as an «outsourcing service provider».
Pitfalls in the terms

Modules: Outage at the IT provider, Loss of income after an attack

4Proofer and freezer room changed via remote maintenance

Receipt

Bakery and confectionery

Tap a line for the reasoning

  • Spoiled dough pieces and semi-finished products CHF 2'000–15'000 not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Assumption: 1–5 days’ production of dough; based on around CHF 3'250 revenue/day (SFTA 2024), cost of goods not documented.

  • Technician: reset and secure the control system CHF 810–3'400 covered

    Control system = IT system, restoration covered; technician’s hourly rate as an assumption. How we got there: 3–10 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Loss of revenue in the branches CHF 810–1'600 not covered

    Consequence of property damage (spoiled goods): AXA B6 and Helvetia exclude the loss of income. How we got there: ½–1 days × around CHF 3'250 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 2'810–16'600

Usually paid by the cyber policy
CHF 810–3'400
Open or only with an add-on
nothing

Likelihood low

During the night, an attacker uses remote maintenance to change the temperatures of the proofers and the freezer room. The dough pieces for the morning are over-proofed, and the frozen semi-finished products have thawed.

How it unfolds

The branches open with half the range, and the baker bakes more with emergency dough.

Entry point: Control system of refrigeration and proofing equipment accessible from the internet

What AI changes: As with the butcher’s shop: AI lowers the effort needed to find open control systems on a large scale.

Why low? The wave of attacks on refrigeration control systems in retail from October 2026 is documented; no case is known for bakeries and proofers.

Where does it say so?

CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

«Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

What prevents it

  • Remote maintenance of the equipment only via VPN; ask the manufacturer about updates.
  • Temperature alarm by SMS with a separate sensor.
  • Emergency plan: basic range from reserve frozen goods.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Property insurance usually does not help: refrigerated goods are insured there only as an add-on and only in the event of a technical defect or power interruption (AXA property B8, Allianz C6.3.3); AXA excludes operating errors (B8.5) and, in the catch-all provision, hacker attacks (let. s), Mobiliar All Risks excludes cyber risks (section 3).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung, Ausgabe 06.2024 (16373DE – 2024-06), Nicht genannte Gefahren, lit. s

    «Schäden verursacht durch Schadprogramme, Hacker- und Denial-of-Service-Angriffe sowie andere Cyber-Ereignisse.»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung (opens in a new window), retrieved 06.11.2026

  • Control systems of machines and installations count as part of the IT system: forensics and restoration of the control software are covered (AXA E11; Zurich Art. 102.1 names medical, production and control technology).
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 102.1

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Property damage caused by an attack, Restore data and systems, Loss of income after an attack

5Price screens show propaganda

Receipt

Bakery and confectionery

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'000–6'400 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 4–16 h × CHF 250–400/h (market range for incident response)

  • Reset the display system CHF 900–4'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 5–20 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Crisis communication with customers and the media no reliable figure covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: Hourly rate for crisis PR not found; Mobiliar pays PR without consent up to CHF 10'000.

  • Customers stay away (reputational damage) no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 1'900–10'900, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood low

Attackers hijack the central server that controls the screens in all branches. Instead of prices and offers, political messages appear, and in some branches screams can be heard.

How it unfolds

The screens are switched off, and customers and the media ask questions.

Entry point: Poorly protected server or cloud account of the display system

What AI changes: AI can generate text and audio content quickly; the attack itself does not need AI.

Why low? Documented at more than 100 bakery branches in Germany in 2025; no case known in Switzerland.

What prevents it

  • Access to the display system with its own password and two-factor login.
  • Separate the display system from the till network.
  • Store an emergency contact with the provider.
Pitfalls in the terms

Modules: Immediate help in an emergency, Restore data and systems, Reputational damage

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 3'250 Average revenue per day; your business may be smaller.

CHF 700–1'600 Annual premium for a micro business, indicative value based on the Helvetia rate, group C, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group C (among others, retail, food production, metal goods, doctors, lawyers); this assignment is ours, not the insurer’s.

Indicative premiums for Bakery and confectionery per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 700–1'600Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote. Butcher’s shop is not named literally in the application; Group C via «retail» and «manufacture of food».

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 1'100–2'800Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

Real cases

  • Switzerland · 04.2025

    Swiss municipalities (anonymous)

    In April 2025, municipalities increasingly reported emails to the NCSC from supposed mayors or municipal presidents.

  • Switzerland · 12.2024

    Churches, schools, associations and political parties (anonymous)

    In December 2024, the NCSC received numerous reports of CEO fraud against churches, schools, associations and political parties whose websites show many names and roles.

  • Switzerland · 05.2023

    Unico Data AG

    In May 2023, the group «Play» attacked the provider of IT solutions for SMEs; most services were then offline.

6 more cases and sample cases

  • Switzerland · 04.2026

    Municipality of Vétroz

    In April 2026, an attack, presumably by the Akira group, hit an IT service provider of the municipality in Valais.

  • GermanyAbroad: Germany

    Grocery shop (anonymous)

    An employee opened an email with a supposed job application, whereupon malware was installed.

  • Sweden · 07.2021Abroad: Sweden

    Coop Sverige (not Coop Switzerland)

    At the beginning of July 2021, REvil distributed ransomware via a fake update of the remote maintenance software Kaseya VSA.

  • France · 10.2026Abroad: France

    Intermarché, Coopérative U, Carrefour (more than 230 branches)

    During the night before 12 October 2026, attackers switched the refrigeration and freezer systems of around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops to defrost mode; for around six hours the temperature rose to as much as 50 degrees.

  • Germany · 11.2026Abroad: Germany

    Edeka supermarket Reisbach

    Edeka Reisbach: refrigeration systems were connected to the internet for remote monitoring.

  • Germany · 07.2025Abroad: Germany

    Heidebäckerei Meyer and Bäckerei Engelke

    Attackers hijacked the central server used to control the screens in more than 100 bakery branches, including all 108 locations of Heidebäckerei Meyer.

Three ways forward