Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Municipality and public administration: what can happen, and who pays?

limited 5 of 10 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Ransomware, residents’ data on the darknet” (likelihood high).

As of

Municipality4. Website overloaded on voting Sunday43. Fake mayor asks for gift cards32. The municipality’s IT service provider attacked21. Ransomware, residents’ data on the darknet15. Water supply control system attacked5

Website overloaded on voting Sunday

Fake mayor asks for gift cards

The municipality’s IT service provider attacked

Ransomware, residents’ data on the darknet

Water supply control system attacked

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. Connected
  3. Real cases

5 scenarios, 5 receipts

  1. Ransomware, residents’ data on the darknet
  2. The municipality’s IT service provider attacked
  3. Fake mayor asks for gift cards
  4. Website overloaded on voting Sunday
  5. Water supply control system attacked

1Ransomware, residents’ data on the darknet

Receipt

Municipality and public administration

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 5'400–22'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 30–100 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–14'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of residents by letter (postage only) CHF 2'000–7'200 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 2'000–6'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Additional costs for staff and external help no reliable figure unclear

    For municipalities, what counts is not loss of income but additional costs; whether SME cyber products are open to public bodies has not been checked. How we got there: No revenue; comparison district of Anhalt-Bitterfeld (DE): EUR 2.5 million total costs.

Usually paid by the cyber policy
CHF 14'900–75'700
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood high

The administration of a municipality with 5'400 residents falls victim to ransomware. At first, there is talk of a weak attack; later the press reveals that data of all residents, including AHV numbers, is on the darknet.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why high? Several Swiss municipalities affected (Rolle 2021, Saxon 2023, Matten 2026, Vétroz 2026).

What prevents it

  • Offline backup and restoration exercise.
  • Crisis communication prepared.
  • Minimise data.
Pitfalls in the terms
  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • State attacks: Mobiliar links the war exclusion to attributions by governments or the UN/NATO (E let. b); pro-Russian DDoS groups more often hit public authorities.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil E lit. b

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Inform affected people, Loss of income after an attack

2The municipality’s IT service provider attacked

Receipt

Municipality and public administration

Tap a line for the reasoning

  • Additional costs and delays no reliable figure unclear

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood high

An attack on the IT service provider paralyses the counter, residents’ registration and building permits for several days; even after ten days, payments and invoices are not fully working.

How it unfolds

Entry point: Supply chain

What AI changes: AI helps to exploit many customers of a service provider.

Why high? Vétroz 2026, Xplain 2023.

What prevents it

  • Contract with the service provider: security standard, emergency, reporting.
  • Paper processes for the counter.
  • Critical data available locally.
Pitfalls in the terms

Modules: Outage at the IT provider

3Fake mayor asks for gift cards

Receipt

Municipality and public administration

Tap a line for the reasoning

  • Cards purchased or transfer CHF 300–10'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: NCSC: often several hundred francs, below internal limits.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 300–10'000
Usually stays with the business
nothing

Likelihood high

Employees receive emails from the supposed mayor asking for online gift cards or an urgent transfer.

How it unfolds

Entry point: Fake senders

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why high? NCSC April 2025: increased reports from municipalities.

What prevents it

  • Rule: the mayor’s office never asks for gift cards.
  • Call back.
  • Flag external senders.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Website overloaded on voting Sunday

Receipt

Municipality and public administration

Tap a line for the reasoning

  • Additional communication costs no reliable figure unclear

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood medium

A DDoS attack on the website provider paralyses dozens of municipal websites on voting Sunday until the afternoon.

How it unfolds

Entry point: DDoS on the provider

What AI changes: Hardly any AI connection.

Why medium? Aargau 2024 (68 municipalities with the provider); WEF DDoS 2025.

What prevents it

  • Also publish results via a second channel.
  • Require DDoS protection from the provider.
  • Communication plan.
Pitfalls in the terms

Modules: Outage at the IT provider

5Water supply control system attacked

Receipt

Municipality and public administration

Tap a line for the reasoning

  • Check and restore the control system CHF 2'700–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 10–40 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Consequential damage no reliable figure not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 2'700–13'500
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood low

Unknown persons attack the control system of a water supply via the internet; an AI had suggested exposed systems as targets.

How it unfolds

Entry point: Exposed control system

What AI changes: According to the NCSC, AI will in future enable even perpetrators without specialist knowledge to attack industrial control systems.

Why low? Case in Mexico 2026 (according to the NCSC with AI); no public case in Switzerland.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Never connect control systems directly to the internet.
  • Remote access only via VPN.
  • Practise manual emergency operation.
Pitfalls in the terms

Modules: Restore data and systems, Property damage caused by an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What is connected in the business

Real cases

  • Switzerland · 05.2021

    Municipality of Rolle

    At the end of May 2021, the administration of the municipality in the canton of Vaud with around 5400 residents fell victim to a ransomware attack.

  • Switzerland · 04.2023

    Municipality of Saxon

    At the end of April 2023, unknown persons broke into the systems of the guardianship authority of the municipality of Saxon in Valais; according to the cantonal police, data was stolen and encrypted.

  • Switzerland · 03.2026

    Municipality of Matten

    The municipality of Matten suffered an attack in which part of its data was encrypted.

7 more cases and sample cases

  • Switzerland · 04.2026

    Municipality of Vétroz

    In April 2026, an attack, presumably by the Akira group, hit an IT service provider of the municipality in Valais.

  • Switzerland · 05.2023

    Xplain AG

    In May 2023, the group «Play» attacked the IT service provider Xplain and published captured data on the darknet.

  • Switzerland · 04.2025

    Swiss municipalities (anonymous)

    In April 2025, municipalities increasingly reported emails to the NCSC from supposed mayors or municipal presidents.

  • Switzerland · 11.2024

    Aargau municipalities (customers of the website provider Backslash)

    On voting Sunday, 24 November 2024, a DDoS attack on the eastern Swiss website provider Backslash paralysed numerous municipal websites, including Aarau, Baden and Brugg; Backslash serves 68 municipalities in Aargau.

  • Switzerland · 01.2025

    SH Power

    During the WEF in January 2025, attacks by the pro-Russian group NoName057(16) overloaded websites of cities, cantons and banks.

  • Germany · 07.2021Abroad: Germany

    District of Anhalt-Bitterfeld

    After a ransomware attack, on 9 July 2021 the district became the first German local authority to declare a state of disaster because of a hacker attack.

  • Mexico · 2026Abroad: Mexico

    Water supply (not named)

    At the beginning of 2026, unknown persons attacked a water supply in Mexico.

Three ways forward