Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Garage and car dealership: what can happen, and who pays?

limited 6 of 13 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Customer pays fraudsters for a used car” (likelihood high).

As of

Garage5. Vehicle sold to a stolen identity51. Customer pays fraudsters for a used car14. Trojan triggers payments in e-banking43. Ransomware with published customer data32. The provider’s dealer software hacked2

Vehicle sold to a stolen identity

Customer pays fraudsters for a used car

Trojan triggers payments in e-banking

Ransomware with published customer data

The provider’s dealer software hacked

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Customer pays fraudsters for a used car
  2. The provider’s dealer software hacked
  3. Ransomware with published customer data
  4. Trojan triggers payments in e-banking
  5. Vehicle sold to a stolen identity

1Customer pays fraudsters for a used car

Receipt

Garage and car dealership

Tap a line for the reasoning

  • Purchase price with the fraudster CHF 10'000–40'000 not covered

    The customer’s money, not the garage’s: only Helvetia 3.3.1.8 let. b covers this constellation (sub-limit). How we got there: Documented: CHF 18'000 (CH), just under EUR 17'000 (DE).

  • Liability claim by the customer CHF 0–40'000 unclear

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: OLG Oldenburg: the buyer had to pay again because no security deficiency could be proven against the car dealership; open in Switzerland.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually stays with the businessCHF 10'000–40'000

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
CHF 0–40'000

Likelihood high

A customer buys a used car and receives the invoice for CHF 18'000 by email. Shortly afterwards, a request comes from the hacked garage account to pay into a foreign account «for logistical reasons».

How it unfolds

The customer pays and wants to collect the car.

Entry point: Hacked email account of the garage

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why high? Real Swiss case (NCSC); in Germany, several judgments concerning car dealerships.

What prevents it

  • Two-factor login for all email accounts.
  • Purchase contracts with a fixed IBAN and the note «no changes by email».
  • For vehicle purchases, confirm receipt of payment by telephone before handover.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Legal position: in Germany, the buyer had to pay again because no security deficiency could be proven against the car dealership (OLG Oldenburg); no judgment found for Switzerland.

Modules: Fraud with fake instructions, Third-party claims after a data breach, Immediate help in an emergency

2The provider’s dealer software hacked

Receipt

Garage and car dealership

Tap a line for the reasoning

  • Loss of revenue and additional work CHF 12'900–25'800 limited

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: 5–10 days × around CHF 12'890 revenue/day × 20% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Set up workarounds CHF 900–3'400 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 5–15 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 13'800–29'200
Usually stays with the business
nothing

Likelihood medium

The provider of the dealer software is hit by ransomware. For two weeks, workshop orders, parts orders and vehicle sales are only possible on paper, and invoices pile up.

How it unfolds

Entry point: Attack on the software provider

What AI changes: AI shortens the time it takes attackers to find data at large providers.

Why medium? In North America in 2024, more than 15'000 car dealerships were affected (CDK); no Swiss case known.

What prevents it

  • Emergency forms for workshop and sales.
  • Regular data export from the cloud.
  • Check the contract with the provider regarding downtime.
Pitfalls in the terms

Modules: Outage at the IT provider, Loss of income after an attack

3Ransomware with published customer data

Receipt

Garage and car dealership

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 3'800–20'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 15–50 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–7'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 2'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 2'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Loss of revenue CHF 6'400–19'300 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 1–3 days × around CHF 12'890 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 10'600–52'500
Open or only with an add-on
CHF 6'400–19'300
Usually stays with the business
nothing

Likelihood medium

A ransomware group encrypts parts of the systems and publishes customer data (names, vehicles, leasing data). The garage has to inform customers and report to the FDPIC.

How it unfolds

Entry point: Email or remote access

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real case Emil Frey 2022 (Hive), data from CH and DE published.

What prevents it

  • Store customer data only for as long as necessary.
  • Separate the networks of workshop, sales and office.
  • Backups offline.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Inform affected people, Loss of income after an attack

4Trojan triggers payments in e-banking

Receipt

Garage and car dealership

Tap a line for the reasoning

  • Amount lost CHF 10'000–60'000 add-on

    Add-on at AXA (with 2FA), Mobiliar, Zurich (Cyber-Crime); Helvetia in the basic cover with sub-limit; Sunrise excluded. How we got there: Assumption; Zurich sample case CHF 130'000 (fiduciary).

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'000–4'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 4–12 h × CHF 250–400/h (market range for incident response)

Usually paid by the cyber policy
CHF 1'000–4'800
Open or only with an add-on
CHF 10'000–60'000
Usually stays with the business
nothing

Likelihood low

A banking Trojan gets onto the accounting PC via an attachment. At the next login, it slips in a payment of CHF 45'000 to a third-party account.

How it unfolds

Entry point: Malware on the accounting PC

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Zurich fiduciary sample case; today banks offer better protection with two-factor approval.

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • E-banking only on a separate, clean device.
  • Payment approval with a second factor and limits.
  • Activate bank notifications for every payment.
Pitfalls in the terms

Modules: Hacked e-banking, Immediate help in an emergency

5Vehicle sold to a stolen identity

Receipt

Garage and car dealership

Tap a line for the reasoning

  • Vehicle value CHF 20'000–80'000 limited

    Helvetia 3.3.1.8 let. c covers orders for goods placed using someone else’s identity (sub-limit); other insurers: not governed, or property insurance (fraud usually excluded). How we got there: Assumption: one to two used cars.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 20'000–80'000
Usually stays with the business
nothing

Likelihood low

A buyer with genuine but stolen ID and company data orders two vehicles online on invoice or leasing. The vehicles are collected and disappear, and the real person knows nothing about it.

How it unfolds

Entry point: Order with a stolen identity

What AI changes: AI forges ID cards and documents more convincingly.

Why low? Helvetia expressly insures «Fake Identity Fraud»; Swiss garage cases are not public.

Where does it say so?

Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026

Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Check original ID documents on collection.
  • Hand over vehicles only after payment has been received.
  • For new customers, call back on an independently researched number.
Pitfalls in the terms

Modules: Fraud with fake instructions

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 12'890 Average revenue per day; your business may be smaller.

CHF 800–3'100 Annual premium for a micro business, indicative value based on the Helvetia rate, group B, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group B (among others, consulting, hotel, motor vehicle trade); this assignment is ours, not the insurer’s.

Indicative premiums for Garage and car dealership per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

Real cases

  • Switzerland · 06.2022

    Garage (anonymous) and its customer

    A customer bought a used car from a garage and received the invoice for more than 18'000 francs by email.

  • Switzerland · 01.2022

    Emil Frey Group

    On 11 January 2022, the ransomware group Hive attacked the Emil Frey Group, one of the largest car dealers in Europe, and demanded a ransom for decryption and non-publication.

  • GermanyAbroad: Germany

    Private buyer of a used car (anonymous)

    A buyer’s daughter asked a car dealership by email for its bank details; unknown persons intercepted the exchange and sent a PDF with a changed IBAN.

3 more cases and sample cases

  • USA · 06.2024Abroad: USA

    CDK Global and affiliated car dealerships

    In June 2024, the BlackSuit group paralysed the software provider CDK Global, whose systems for sales, workshop and stock are used by more than 15'000 car dealerships in North America.

  • Sample case from an insurer: Zurich

    Fiduciary firm (CHF 6.5 million revenue, 22 employees) executes payments for clients. An employee opens a supposed unsolicited job application containing malware; the hacker takes over the e-banking session at login and diverts money from client accounts. Total according to the insurer: CHF 142'000.

    Sample case («Treuhand-Muster AG»). Cyber-Crime (e-banking hacking) only in the Premium package; forensics found no data outflow.

    Where does it say so?

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, Schadenbeispiel Treuhänder (1/2 und 2/2)

    «Den Kunden vom Treuhandbüro wurden insgesamt 130’000 Schweizer Franken gestohlen, aus einem vom Versicherten verwalteten Konto.»

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial)

    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Three ways forward