Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Trades (electrical, plumbing, joinery, painting): what can happen, and who pays?

limited 7 of 17 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Hacked email account: customer pays invoice into the wrong account” (likelihood high).

As of

Trades1. Hacked email account: customer pays invoice into the wrong account13. Fake invoice from the wholesaler32. Logged in via VPN on a Sunday, server encrypted24. Joinery’s CNC machine manipulated45. Fraudsters copy the website and collect advance payments5

Hacked email account: customer pays invoice into the wrong account

Fake invoice from the wholesaler

Logged in via VPN on a Sunday, server encrypted

Joinery’s CNC machine manipulated

Fraudsters copy the website and collect advance payments

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Hacked email account: customer pays invoice into the wrong account
  2. Logged in via VPN on a Sunday, server encrypted
  3. Fake invoice from the wholesaler
  4. Joinery’s CNC machine manipulated
  5. Fraudsters copy the website and collect advance payments

1Hacked email account: customer pays invoice into the wrong account

Receipt

Trades (electrical, plumbing, joinery, painting)

Tap a line for the reasoning

  • Outstanding payment for work (customer paid fraudsters) CHF 5'000–30'000 not covered

    Most policies only reimburse the policyholder’s own money transferred (Mobiliar B8, Zurich Art. 702, AXA A6). Exception: Helvetia 3.3.1.8 let. b covers payments by third parties after manipulation of the policyholder’s own bank details, up to a sub-limit of CHF 30'000–100'000. How we got there: Documented comparable cases: CHF 18'000 (garage, CH), EUR 15'000 (heating, DE), EUR 11'000 (fence construction, DE).

  • Liability claim by the customer (inadequate security of email transmission) CHF 0–30'000 unclear

    Cyber liability covers claims arising from data protection and network security breaches; whether the customer’s payment loss falls under this is not governed. How we got there: In Germany: OLG Schleswig 2024, the customer does not have to pay again (damages under the GDPR); LG Koblenz 2025, split 75/25; OLG Oldenburg, the buyer has to pay again. No judgment found for Switzerland.

  • Check the mailbox (forwarding rules, unknown logins), password reset CHF 750–4'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–12 h × CHF 250–400/h (market range for incident response)

  • Lawyer: dispute with the customer, criminal complaint, bank recall CHF 750–5'200 covered

    Often covered via cyber legal protection (Mobiliar, Zurich, Helvetia each CHF 50'000). How we got there: 3–15 h × CHF 250–350/h (lawyer’s rate in Switzerland)

Usually stays with the businessCHF 5'000–30'000

Usually paid by the cyber policy
CHF 1'500–10'000
Open or only with an add-on
CHF 0–30'000

Likelihood high

The plumber enters his email password on a fake Microsoft page. For weeks, the perpetrators read along, set up a forwarding rule and send a client the real final invoice again, but with a new IBAN and a new QR code.

How it unfolds

She pays CHF 18'000 to the fraudsters; the plumber sends a reminder, and the customer says she has paid. The two argue about who bears the loss.

Entry point: Phishing of the email password without two-factor login

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing. The fake invoice is an exact duplicate of the original.

Why high? Documented several times in Switzerland (garage with an invoice for CHF 18'000, manipulated QR-bill); the NCSC reports 132 cases of invoice manipulation in 2025. In Germany, courts have already ruled against tradespeople.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login for the email account; check forwarding rules monthly.
  • On every invoice: «Our bank details never change by email», and the IBAN also in the quote and order confirmation.
  • Send invoices via a portal or signed; for large amounts, actively check that payment has been received.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • No Swiss case law found: whether the customer has to pay again is an open question; German courts have ruled differently depending on the security of the email transmission and the customer’s diligence.

Modules: Fraud with fake instructions, Third-party claims after a data breach, Immediate help in an emergency

2Logged in via VPN on a Sunday, server encrypted

Receipt

Trades (electrical, plumbing, joinery, painting)

Tap a line for the reasoning

  • Incident response, negotiation with the extortionists, loss analysis CHF 5'000–24'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–60 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 8'100–27'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 30–80 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Resetting the workstations (PCs, tablets) CHF 1'400–16'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 8–20 devices × CHF 180–800 per device

  • Loss of revenue for five days CHF 4'500–25'100 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 3–5 days × CHF 3'010–10'050 revenue/day × 50% (assumption: construction sites partly continue) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Ransom demand (not paid) no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Demanded: 300'000 US dollars; Helvetia ECO would pay at most CHF 30'000.

Usually paid by the cyber policy
CHF 14'500–67'000
Open or only with an add-on
CHF 4'500–25'100, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

On a Sunday, attackers log in via VPN access with stolen login data, create a second administrator account and encrypt the servers. They demand 300'000 US dollars. Via the insurer’s hotline, an IT security company negotiates the same day; nothing is paid.

How it unfolds

After five days the IT is running again, and five working days of data are missing.

Entry point: VPN without two-factor login, stolen login data

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real Swiss case of a trade business (Helvetia, 2025); Akira attacked around 200 Swiss companies in 2023–2025, often via VPN.

What prevents it

  • Two-factor login for VPN and all remote access.
  • Backups immutable or offline; monitor admin accounts.
  • Keep the insurer’s emergency number to hand (also on Sundays).
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Criminal complaint: for ransomware (Zurich Art. 10.1), extortion (Mobiliar, Helvetia) and cyber fraud (Helvetia 3.3.1.8), reporting to the police is a precondition for the benefit.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8

    «sofern eine Strafanzeige erstattet wird»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Cyber extortion

3Fake invoice from the wholesaler

Receipt

Trades (electrical, plumbing, joinery, painting)

Tap a line for the reasoning

  • Monthly invoice transferred CHF 5'000–50'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Assumption: monthly invoice for materials; no sector source.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 5'000–50'000
Usually stays with the business
nothing

Likelihood medium

The bookkeeper receives an email from the plumbing wholesaler with a new IBAN; the logo, customer number and orders are correct. She pays the monthly invoice of CHF 25'000 into the wrong account.

How it unfolds

Entry point: Hacked email account of the supplier

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? NCSC: invoice manipulation reported regularly, individual losses of up to CHF 1.5 million.

Where does it say so?

Halbjahresbericht 2025/II (Juli–Dezember), 30.03.2026

Open document: Halbjahresbericht 2025/II (Juli–Dezember) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Call back on the known number for every new IBAN, documented.
  • Four-eyes principle above a certain amount.
  • Ask suppliers to confirm IBAN changes in writing by post.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Mobiliar does not pay if a payment request was evidently forged or not personalised, or concerns goods that were never ordered (B8.2 let. c).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.2 lit. c

    «weil Sie frei erfundene oder erkennbar gefälschte Zahlungsaufforderungen bezahlt haben»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Joinery’s CNC machine manipulated

Receipt

Trades (electrical, plumbing, joinery, painting)

Tap a line for the reasoning

  • Machine manufacturer and IT: reset the control system CHF 1'400–4'500 covered

    Control system = IT system (AXA E11, Zurich 102.1): covered. Zurich sample case: machine manufacturer CHF 7'000. How we got there: 8–20 h × CHF 180–225/h (IT support for SMEs, office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'500–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 6–20 h × CHF 250–400/h (market range for incident response)

  • Repair of the spindle (property damage to the machine) no reliable figure not covered

    Cyber excluded. Engineering insurance: Allianz covers failure of control and safety devices, but excludes changes to operating systems caused by viruses; open. How we got there: Comparison with Zurich property factsheet: motor of a CNC milling machine CHF 8'000 (technical defect).

  • Incorrectly milled series (material and working time) CHF 2'000–15'000 not covered

    In the OT sample case, Helvetia pays «financial losses from the defective production series»; however, the «Mangelhafte Produktion» module is not part of KMU-Spezial. How we got there: Assumption: one order series; not documented.

  • Loss of revenue from the machine CHF 2'700–15'100 unclear

    Covered if the interruption results from the IT outage; AXA excludes loss of income arising from property damage (B6). How we got there: 3–5 days × CHF 3'010–10'050 revenue/day × 30% (assumption: share of machine work) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 2'000–15'000

Usually paid by the cyber policy
CHF 2'900–12'500
Open or only with an add-on
CHF 2'700–15'100
Usually stays with the business
plus 1 item without an amount

Likelihood low

Via the machine manufacturer’s remote maintenance access, an attacker changes parameters of the CNC machining. A series of kitchen fronts is milled incorrectly, and the spindle is damaged during a tool change.

How it unfolds

The machine is out of action for a week, and an order is delayed.

Entry point: Manufacturer’s remote maintenance access permanently open

What AI changes: AI helps to evaluate machine parameters and manuals; an attack nevertheless remains laborious.

Why low? Zurich describes remote access to production machines as a sample case; manipulations with property damage at small joineries are not publicly documented.

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • Enable remote maintenance only on request by phone and disconnect it afterwards.
  • Separate the machine network from the office network.
  • Request a parameter backup of the control system from the manufacturer.
Pitfalls in the terms

Modules: Restore data and systems, Immediate help in an emergency, Property damage caused by an attack, Loss of income after an attack

5Fraudsters copy the website and collect advance payments

Receipt

Trades (electrical, plumbing, joinery, painting)

Tap a line for the reasoning

  • Lawyer: domain block, defence against claims, criminal complaint CHF 1'200–7'000 unclear

    No attack on the business’s own system: not an insured event in most cyber GTC; cyber legal protection can help. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Reputational damage, time spent no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'200–7'000
Usually stays with the business
1 item without an amount

Likelihood low

Perpetrators copy the website, address and commercial register data of a painting business onto a similar domain and sell supposed remaining stock or appointments there against advance payment. Defrauded buyers call the real business and threaten to report it.

How it unfolds

The business has to have the domain blocked and inform customers.

Entry point: None at the business itself: misuse of the name

What AI changes: AI builds a deceptively real copy of the website in minutes.

Why low? Documented at a German watchmaker in 2026 (around 80 defrauded customers); no trade case known in Switzerland.

What prevents it

  • Regularly search the internet for your own company name; set up a Google Alert.
  • Register similar domains (.ch/.com) yourself.
  • State on the website that advance payment to third-party accounts is never requested.
Pitfalls in the terms

Modules: Media liability, Reputational damage

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 3'010–10'050 Average revenue per day; your business may be smaller.

CHF 300–750 Annual premium for a micro business, indicative value based on the Helvetia rate, group A, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group A (among others, main and ancillary construction trades, café/restaurant); this assignment is ours, not the insurer’s.

Indicative premiums for Trades (electrical, plumbing, joinery, painting) per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 300–750Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, S. 15

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group A (trades, restaurant) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 550–1'200Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group A (trades, restaurant)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

  • Email account (often Microsoft 365) for quotes and invoices as PDF Documented case: Trade business (anonymous)
  • Sector software for quotes, reports, invoices; server or cloud Common in the sector.
  • CNC machines and panel saws with remote maintenance (joinery) Allianz insures CNC controls under its engineering insurance (G1.1 let. d).
    Source

    AB CombiRisk Business, G Technik-Versicherung, Ausgabe 03.2019

    Open document: AB CombiRisk Business, G Technik-Versicherung (opens in a new window), retrieved 06.11.2026

  • Smartphones and tablets on the construction site Common in the sector.
  • VPN access for remote work In the Helvetia case, VPN access was the point of entry.
  • E-banking

Real cases

  • Switzerland · 06.2022

    Garage (anonymous) and its customer

    A customer bought a used car from a garage and received the invoice for more than 18'000 francs by email.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 10.2025

    Around 200 companies in Switzerland (anonymous)

    Between May 2023 and September 2025, the Akira group attacked around 200 companies in Switzerland with ransomware, most recently four to five cases a week.

9 more cases and sample cases

  • GermanyAbroad: Germany

    Trade business (anonymous)

    A trade business sent interim and final invoices as PDFs by email; on the final invoice for 15'000 euros, unknown persons changed the account details, and the customer paid third parties.

  • Germany · 07.2022Abroad: Germany

    Fence builder (anonymous)

    Two days after the invoice for 11'000 euros for a garden fence, the customer received new bank details from the tradesperson’s supposed email account and transferred the amount in two instalments to a fraudster.

  • GermanyAbroad: Germany

    Private buyer of a used car (anonymous)

    A buyer’s daughter asked a car dealership by email for its bank details; unknown persons intercepted the exchange and sent a PDF with a changed IBAN.

  • Germany · 02.2026Abroad: Germany

    Master watchmaker Peter-Jesko Buse

    At the end of February 2026, a supposed customer asked about a watch that the 83-year-old master watchmaker had never sold.

  • Real case, published by the insurer: Helvetia

    Trade business (name not given): attackers log in via VPN on a Sunday, create a second admin account, encrypt the servers and demand 300'000 US dollars. The Helvetia hotline brings in Compass Security, which negotiates the same day. No ransom paid; after 5 days the IT is running again, and data loss is limited to 5 working days thanks to protected backups.

    Real case from the insurer’s perspective, without amounts in francs. The BI payment is mentioned only in the Südostschweiz version (promoted content with Helvetia, 30.04.2026, https://www.suedostschweiz.ch/themenwelten/digitale-sicherheit-wird-zur-schluesselaufgabe-fuer-kmu-1652907): «In addition, Helvetia covered the financial loss resulting from the business interruption.» There, the demand is only described as «six-figure». Lesson: protected backups shorten the outage to days.

    Where does it say so?

    Ratgeber Cyberangriff auf KMU (Fallbeispiel Handwerksbetrieb), 27.08.2025, Fallbeispiel Ransomware

    «Für die Systemfreigabe forderten die Angreifenden ein Lösegeld in Höhe von 300'000 US-Dollar.»

    Open document: Ratgeber Cyberangriff auf KMU (Fallbeispiel Handwerksbetrieb) (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Zurich

    Manufacturer of metal parts (CHF 3 million revenue, 15 employees): on a Sunday, a hacker uses a stolen password to get in through the remote maintenance access of the production machines and blocks the IT; 5 days without production, an urgent order worth CHF 80'000 has to be cancelled, and a second order can only be fulfilled with weekend shifts. Total according to the insurer: CHF 89'000.

    Sample case with a fictitious company («Metallteile-Muster AG»), not documented as a real loss. BI only in Optimum/Premium. At Zurich, control/production technology is part of the insured network.

    Where does it say so?

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, Schadenbeispiel Hersteller (1/2 und 2/2)

    «Übersicht der versicherten Kosten in diesem Beispiel: CHF 89’000 (Abzug von Selbstbehalt je nach Vereinbarung vorbehalten)»

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Helvetia

    Through phishing, a hacker obtains access data at a highly digitalised production business, gets into the machine network and changes parameters; a machine fails, and a defective production run results.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package». The benefit for the defective production series corresponds to the Helvetia module «Mangelhafte Produktion», which according to the GTC is not part of KMU-Spezial; the machine failure itself (property damage) is not mentioned as a benefit. According to the brochure, OT also includes refrigeration and heating technology.

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 6/9, «OT-Steuerungen gehackt»

    «Da die Manipulation nicht sofort bemerkt wird, fällt eine Maschine aus, und es entsteht eine fehlerhafte Produktionsreihe.»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

  • Sample case from a property insurer, for comparison: Zurich

    New CNC milling machine with internal operational damage, motor defective and replaced. Not a cyber case. Total according to the insurer: CHF 8'000.

    Distinction: machinery insurance pays for the technical defect. If the machine is damaged by manipulated controls, the cyber insurance pays only for the controls (data/software), not for the machine.

    Where does it say so?

    Factsheet Zurich Sachversicherung, ZH21646d-2301, Schadenbeispiele, Technische Anlagen/Maschinenversicherung

    «Die neue CNC-Fräse hat einen inneren Betriebsschaden.»

    Open document: Factsheet Zurich Sachversicherung (opens in a new window), retrieved 06.11.2026

  • Real case, published by the insurer: Mobiliar

    Thomas Baltensperger’s joinery: after a hacker attack (one click was enough), the business came to a standstill overnight, with all documents encrypted.

    Real case with names, but without amounts and without stating whether and what Mobiliar paid; details only in the video (cookie consent required, not viewed).

    Where does it say so?

    Cybersicherheit (Themenseite), abgerufen 06.11.2026, Abschnitt zur Schreinerei Baltensperger (Text und Video)

    «Alle Dokumente wurden verschlüsselt»

    Open document: Cybersicherheit (Themenseite) (opens in a new window), retrieved 06.11.2026

Three ways forward