Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Construction company: what can happen, and who pays?

limited 7 of 13 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Project data and cost calculations encrypted” (likelihood medium).

As of

Construction company2. Payment to subcontractor into the wrong account23. Fake boss orders an urgent payment31. Project data and cost calculations encrypted14. Plans of a sensitive building on the darknet45. The client’s plan platform fails5

Payment to subcontractor into the wrong account

Fake boss orders an urgent payment

Project data and cost calculations encrypted

Plans of a sensitive building on the darknet

The client’s plan platform fails

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Project data and cost calculations encrypted
  2. Payment to subcontractor into the wrong account
  3. Fake boss orders an urgent payment
  4. Plans of a sensitive building on the darknet
  5. The client’s plan platform fails

1Project data and cost calculations encrypted

Receipt

Construction company

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Resetting the workstations (PCs, tablets) CHF 900–12'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 5–15 devices × CHF 180–800 per device

  • Reworking lost cost calculations and quantity surveys CHF 5'000–20'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: Comparable case in Ticino: total loss around CHF 20'000 (owner’s estimate).

  • Ransom CHF 2'000 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Comparable case: 2 Bitcoin, around CHF 2'000 (2016).

Usually paid by the cyber policy
CHF 12'000–57'500
Open or only with an add-on
CHF 2'000
Usually stays with the business
nothing

Likelihood medium

Ransomware encrypts the server with cost calculations, quantity surveys and archives; the perpetrators demand a ransom. The company pays a small amount and receives only some of the keys, and two archives remain locked.

How it unfolds

Quotes for ongoing tenders are delayed.

Entry point: Email attachment or remote access

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Documented Ticino case (2016): around CHF 2'000 ransom paid, loss around CHF 20'000; according to the NCSC, ransomware remains common.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Back up archives offline; test restoring.
  • No ransom payment without advice from the insurer.
  • Remote access with two-factor login.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Cyber extortion

2Payment to subcontractor into the wrong account

Receipt

Construction company

Tap a line for the reasoning

  • Misdirected interim payment CHF 20'000–150'000 add-on

    Only with the add-on; Helvetia at most CHF 30'000–100'000; document the call-back. How we got there: Assumption: one interim payment; NCSC major case CHF 1.5 million.

  • Additional costs due to the subcontractor’s work stoppage CHF 1'500–7'400 not covered

    Not a cyber event in the business’s own system; consequential costs from social engineering are not insured as business interruption. How we got there: 1–5 days × around CHF 14'840 revenue/day × 10% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 1'500–7'400

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 20'000–150'000

Likelihood medium

A subcontractor supposedly sends new bank details; the email comes from his hacked mailbox. The construction company transfers an interim payment of CHF 80'000.

How it unfolds

The subcontractor stops work until he is paid.

Entry point: Hacked email account of the subcontractor

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Invoice manipulation is reported to the NCSC more than 100 times a year; construction involves many large payments.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • IBAN changes only with a call-back and the signature of the management.
  • Payments over CHF 20'000 with a second approval.
  • Lock subcontractor master data.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Loss of income after an attack

3Fake boss orders an urgent payment

Receipt

Construction company

Tap a line for the reasoning

  • Amount transferred CHF 50'000–300'000 not covered

    In the case of a phone call: Helvetia excludes telephone/deepfake, Zurich and Mobiliar require written online orders; if an email was also sent, the add-on may apply. AXA A6 covers telephone, provided it has been agreed as an add-on. How we got there: Documented comparable cases: CHF 300'000 (Valais 2024), Helvetia example around CHF 50'000.

Usually stays with the businessCHF 50'000–300'000

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood medium

The accounts department receives an email from the managing director, followed by a call in his voice: CHF 300'000 must be transferred immediately for a confidential land purchase. She pays.

How it unfolds

Entry point: Fake email and call with a cloned voice

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? Valais 2024: around CHF 300'000 to CEO fraudsters; Schwyz 2026: several million with an AI voice.

What prevents it

  • Code word for payment instructions from the management.
  • No exception to the four-eyes principle, not even for «confidential» matters.
  • Always call back on the stored number.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Plans of a sensitive building on the darknet

Receipt

Construction company

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 3'800–20'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 15–50 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–14'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Claims by the client (security measures, changes to plans) no reliable figure covered

    Cyber liability covers breach of confidential data (AXA), at Helvetia pure financial losses; contractual penalties excluded. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 6'300–34'000, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood low

During an attack on the server, plans, access concepts and personal data of a construction project (e.g. prison, bank, villa) are copied and published on the darknet. The client demands investigations and threatens to claim damages.

How it unfolds

Entry point: Ransomware with data theft (double extortion)

What AI changes: AI helps perpetrators to search stolen data quickly for sensitive content.

Why low? Data exfiltration in ransomware attacks is standard (Akira steals first, then encrypts); cases involving building plans are known from the Xplain leak, not from construction companies.

What prevents it

  • Store sensitive plans only in encrypted form and with restricted access.
  • Clarify security requirements with the client in the contract.
  • Monitor data outflow (unusual uploads).
Pitfalls in the terms

Modules: Immediate help in an emergency, Third-party claims after a data breach

5The client’s plan platform fails

Receipt

Construction company

Tap a line for the reasoning

  • Waiting times and additional work CHF 3'000–7'400 limited

    Covered only if the platform counts as a cloud service used by the insured (AXA E2) or a written contract exists (Mobiliar, Zurich). How we got there: 2–5 days × around CHF 14'840 revenue/day × 10% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Errors due to old versions of the plans (dismantling) no reliable figure unclear

    More a matter for professional liability than cyber. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 3'000–7'400, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood low

The cloud platform through which all parties exchange plans is unavailable for a week after an attack on the provider. The site foreman works with old versions of the plans, leading to errors and waiting times.

How it unfolds

Entry point: Attack on the platform provider

What AI changes: No direct AI connection.

Why low? Supply chain attacks are documented; an outage of a Swiss construction plan platform is not publicly known.

What prevents it

  • Synchronise the current versions of the plans locally.
  • Contract with the platform provider on outages and data export.
  • Agree an emergency process with the site management.
Pitfalls in the terms

Modules: Outage at the IT provider, Property damage caused by an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 14'840 Average revenue per day; your business may be smaller.

CHF 300–750 Annual premium for a micro business, indicative value based on the Helvetia rate, group A, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group A (among others, main and ancillary construction trades, café/restaurant); this assignment is ours, not the insurer’s.

Indicative premiums for Construction company per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 300–750Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, S. 15

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group A (trades, restaurant) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 550–1'200Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group A (trades, restaurant)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

  • Costing and estimating software, server with project archive Documented case: New Job Costruzioni SA
  • Exchange of plans via cloud platforms with clients and subcontractors Common in the sector.
  • Telematics of construction machinery and vehicles Assumption, no source.
  • Email, e-banking with many payments to subcontractors

Real cases

  • Switzerland · 2016

    New Job Costruzioni SA

    Unknown persons encrypted and stole data of the Ticino construction company and demanded a ransom.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 01.2024

    Company (anonymous)

    Fraudsters posed as the boss to a company in Central Valais and demanded a large payment.

4 more cases and sample cases

  • Switzerland · 01.2026

    Company (anonymous)

    Within two weeks, unknown perpetrators called the owner of a company in Schwyz and posed as a well-known business partner using an AI-manipulated voice.

  • Switzerland · 10.2025

    Around 200 companies in Switzerland (anonymous)

    Between May 2023 and September 2025, the Akira group attacked around 200 companies in Switzerland with ransomware, most recently four to five cases a week.

  • Switzerland · 05.2023

    Xplain AG

    In May 2023, the group «Play» attacked the IT service provider Xplain and published captured data on the darknet.

  • Real case, published by the insurer: Helvetia

    Amount only from a search result, check before use. Total according to the insurer: CHF 50'000.

    Uncertain: seen only as a search result excerpt, page without content or 404 when accessed. Whether insured and paid: not stated. Check before using on the website.

    Where does it say so?

    Ratgeber CEO-Fraud, 08.11.2019 (laut Suchergebnis der englischen Fassung), Fallbeispiel

    «Beispielsweise entstand bei einem mittelständischen Unternehmen in der Schweiz ein Schaden von rund 50'000 Schweizer Franken.»

    Open document: Ratgeber CEO-Fraud (opens in a new window), retrieved 06.11.2026

Three ways forward