Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Hairdresser, beauty salon, nail studio: what can happen, and who pays?

limited 4 of 10 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Instagram account taken over and held to ransom” (likelihood high).

As of

Hairdresser1. Instagram account taken over and held to ransom12. Invoice for a business directory entry24. Customer data leaked at the booking provider43. Appointment calendar encrypted, no backups35. Twint and terminal fail5

Instagram account taken over and held to ransom

Invoice for a business directory entry

Customer data leaked at the booking provider

Appointment calendar encrypted, no backups

Twint and terminal fail

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Instagram account taken over and held to ransom
  2. Invoice for a business directory entry
  3. Appointment calendar encrypted, no backups
  4. Customer data leaked at the booking provider
  5. Twint and terminal fail

1Instagram account taken over and held to ransom

Receipt

Hairdresser, beauty salon, nail studio

Tap a line for the reasoning

  • Restore the account, Meta support CHF 360–1'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 2–8 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Loss of bookings via Instagram no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

  • Demand for the return no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Do not pay.

Usually paid by the cyber policy
CHF 360–1'800
Open or only with an add-on
1 item without an amount
Usually stays with the business
1 item without an amount

Likelihood high

A supposed message from the «Instagram Copyright Center» leads to a phishing page. The perpetrators take over the account with several thousand followers, change the name and password and demand money via WhatsApp for its return.

How it unfolds

Entry point: Phishing via Facebook Business Manager

What AI changes: AI generates credible support messages.

Why high? Described several times by the NCSC; social media accounts are central for small businesses.

What prevents it

  • Two-factor login, Business Manager with two admins.
  • Never log in via links in copyright messages.
  • Keep the recovery email and number up to date.
Pitfalls in the terms

Modules: Restore data and systems, Reputational damage, Cyber extortion

2Invoice for a business directory entry

Receipt

Hairdresser, beauty salon, nail studio

Tap a line for the reasoning

  • Invoice paid CHF 300–2'000 not covered

    Non-personalised or evidently forged invoices are excluded (Mobiliar B8.2 let. c); in addition, usually below the deductible. How we got there: Assumption.

Usually stays with the businessCHF 300–2'000

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood high

The salon receives an official-looking invoice for an «entry in the trade register» of CHF 890 and pays it.

How it unfolds

Entry point: Fake or misleading invoice

What AI changes: AI generates official-looking documents.

Why high? A common scam; the FSO counts cyber fraud among the most frequent digital offences.

Where does it say so?

Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500), 23.03.2026

Open document: Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Pay only invoices for services ordered.
  • Check unknown invoices with colleagues or the fiduciary.
  • Pay only after checking against the order.
Pitfalls in the terms

Modules: Fraud with fake instructions

3Appointment calendar encrypted, no backups

Receipt

Hairdresser, beauty salon, nail studio

Tap a line for the reasoning

  • Ransom CHF 930 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Documented: 1'000 euros in Bitcoin (DE 2025), converted at an assumed rate of 0.93.

  • IT help: secure the account, reconstruct data CHF 540–2'200 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 3–10 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Cancelled appointments CHF 590–1'200 limited

    For 1–2 days, the waiting period of 12–24 h applies; Mobiliar pays pro rata for a partial outage (sample case). How we got there: 1–2 days × around CHF 1'180 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 540–2'200
Open or only with an add-on
CHF 1'520–2'130
Usually stays with the business
nothing

Likelihood medium

Attackers hack a salon’s online appointment calendar and encrypt it. The customer database, appointments and accounts are unusable; without a backup, the owner pays 1'000 euros in Bitcoin.

How it unfolds

For two days, no appointments can be managed and no payments accepted.

Entry point: Weak password of the calendar account or phishing

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Documented in Germany (2025); Mobiliar names the salon without appointment management as a sample case.

What prevents it

  • Export the appointment list daily.
  • Two-factor login with the calendar provider.
  • Choose a provider with backup in Switzerland.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

Modules: Cyber extortion, Restore data and systems, Loss of income after an attack

4Customer data leaked at the booking provider

Receipt

Hairdresser, beauty salon, nail studio

Tap a line for the reasoning

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 500–2'100 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 2–6 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 300–2'400 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 300–2'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

Usually paid by the cyber policy
CHF 800–4'500
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood low

Names, mobile numbers and treatment notes leak at the online booking provider; customers receive phishing text messages in the name of the salon.

How it unfolds

Entry point: Leak at the service provider

What AI changes: AI makes text messages personal.

Why low? No Swiss case known; pattern from the hotel sector.

What prevents it

  • No health notes in the booking tool.
  • Provider with a data processing agreement.
  • Warn customers.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people

5Twint and terminal fail

Receipt

Hairdresser, beauty salon, nail studio

Tap a line for the reasoning

  • Loss of revenue CHF 0–300 not covered

    Infrastructure outage excluded; in addition, shorter than the waiting period. How we got there: 2 hours × around CHF 1'180 revenue/day (SFTA 2024), many customers pay in cash or later.

Usually stays with the businessCHF 0–300

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood low

A large DDoS attack on a network provider paralyses card payments and Twint for two hours.

How it unfolds

Entry point: Attack on infrastructure

What AI changes: Hardly any AI connection.

Why low? Swisscom DDoS 2024 documented.

What prevents it

  • Emergency cash box.
  • Offer payment by invoice.
  • No action needed regarding insurance.
Pitfalls in the terms

Modules: Outage at the IT provider

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 1'180 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 04.2022

    Museum (anonymous)

    Via the Facebook Business Manager, a museum received a supposed message from the «Instagram Copyright Help Center» about a copyright infringement.

  • Switzerland · 06.2024

    Influencer (anonymous)

    The Facebook account of an influencer with many followers was hacked; Meta closed it after some follow-up.

  • Switzerland · 09.2026

    Hotel Schweizerhof Lenzerheide

    Criminals stole booking data from a component of the hotel’s booking system and wrote to guests via WhatsApp.

4 more cases and sample cases

Three ways forward