Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Hotel and accommodation: what can happen, and who pays?

limited 12 of 18 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Booking account taken over, guests cheated out of deposits” (likelihood high).

As of

Hotel and accommodation1. Booking account taken over, guests cheated out of deposits13. Ransomware locks hotel software and room cards34. Payouts from Booking.com to someone else’s account45. Telephone system misused for international calls52. Booking data stolen from a software provider2

Booking account taken over, guests cheated out of deposits

Ransomware locks hotel software and room cards

Payouts from Booking.com to someone else’s account

Telephone system misused for international calls

Booking data stolen from a software provider

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Booking account taken over, guests cheated out of deposits
  2. Booking data stolen from a software provider
  3. Ransomware locks hotel software and room cards
  4. Payouts from Booking.com to someone else’s account
  5. Telephone system misused for international calls

1Booking account taken over, guests cheated out of deposits

Receipt

Hotel and accommodation

Tap a line for the reasoning

  • Forensics: clean up computers, check access, secure the extranet CHF 1'500–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 6–20 h × CHF 250–400/h (market range for incident response)

  • Notification of affected guests, hotline by own staff no reliable figure covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: Call centre prices not found; postage CHF 1.00–1.20 per letter, mostly by email.

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'000–5'200 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 4–15 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Claims by affected guests CHF 0–20'000 unclear

    Cyber liability requires a data protection breach or network security breach at the insured; whether the takeover of the portal account is sufficient is not governed. How we got there: Assumption: 0 to 50 guests × up to CHF 400 deposit; in one documented case Booking.com covered additional costs (V-IT-2026-001).

  • Cancellations and reputational damage no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 2'500–13'200, plus 1 item without an amount
Open or only with an add-on
CHF 0–20'000
Usually stays with the business
1 item without an amount

Likelihood high

Reception opens an email from a supposed guest with a link to a «booking portal»; a fake captcha gets the receptionist to run a command that steals login data. The perpetrators log in to the Booking extranet and, via the real messaging system, send guests a request to «confirm the credit card again».

How it unfolds

Dozens of guests pay deposits to the perpetrators, and some later turn up at reception with an invalid booking. Guests, Booking.com and the media contact the hotel.

Entry point: Phishing or malware aimed at the hotel’s extranet account

What AI changes: AI texts in the hotel’s name are linguistically perfect and contain real booking data; fake captchas and portals are quickly built.

Why high? Described several times by the NCSC (2024 and 2025), also documented in Austria and Italy; affects hotels of all sizes.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login in the extranet for every account, no shared logins.
  • Train reception staff: never run commands from captchas (Windows key+R is always fraud).
  • Warn guests in the booking confirmation that the hotel never asks for card details via links.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach, Reputational damage

2Booking data stolen from a software provider

Receipt

Hotel and accommodation

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'500–9'600 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 6–24 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–7'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of guests by letter (postage only) CHF 2'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 2'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Claims by affected guests no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 4'700–28'600, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood high

Via an outdated program of an external software provider, criminals obtain email addresses and future stays of guests. They write to the guests saying the reservation will be cancelled because of a payment error and ask for the card details.

How it unfolds

The hotel warns around 10'000 guests.

Entry point: Supply chain: component of the booking system

What AI changes: AI generates emails in each guest’s language.

Why high? Two Swiss hotel cases documented in 2024 and 2026.

What prevents it

  • Agree data processing, updates and reporting deadlines with the provider in the contract.
  • Have a warning notice to guests prepared.
  • Pass only the necessary data to third-party systems.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach

3Ransomware locks hotel software and room cards

Receipt

Hotel and accommodation

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 5'400–20'300 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Resetting the workstations (PCs, tablets) CHF 900–12'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 5–15 devices × CHF 180–800 per device

  • Loss of revenue (cancellations, services that cannot be invoiced) CHF 2'500–7'500 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 1–3 days × around CHF 8'340 revenue/day × 30% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Ransom (not recommended) CHF 1'500 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Comparable case in Austria: around EUR 1'500 paid (2017).

Usually paid by the cyber policy
CHF 8'800–48'300
Open or only with an add-on
CHF 4'000–9'000
Usually stays with the business
nothing

Likelihood medium

On a fully booked weekend, ransomware encrypts the hotel server. Neither check-in nor invoicing is possible, and the locking system does not programme any new room cards.

How it unfolds

The staff keep lists by hand and open rooms with the master key.

Entry point: Application or guest email with malware, old remote access

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Documented at an Austrian hotel (locking system) and a Zurich hotel (Trojan in a job application).

What prevents it

  • Locking system and building services in their own network.
  • Emergency folder: print the guest list daily, mechanical emergency keys.
  • Backups offline, test restoring.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Cyber extortion

4Payouts from Booking.com to someone else’s account

Receipt

Hotel and accommodation

Tap a line for the reasoning

  • Missed payouts CHF 41'700–125'100 unclear

    No attack on the business’s own IT system and no payment triggered by the hotel: neither social engineering (own transfer) nor e-banking cover clearly fits. Helvetia 3.3.1.8 requires manipulation on the insured’s IT system. How we got there: 10–30 days × around CHF 8'340 revenue/day × 50% (assumption: share of portal bookings) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
CHF 41'700–125'100
Usually stays with the business
nothing

Likelihood medium

After a phishing attack, the perpetrators change the bank details for payouts in the extranet. Booking.com transfers a month’s takings to a foreign account.

How it unfolds

The hotel only notices during the monthly reconciliation.

Entry point: Takeover of the extranet account

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Listed by the Austrian Economic Chamber as a warning example; no public case for Switzerland.

What prevents it

  • Two-factor login and notification when bank details are changed in the extranet.
  • Reconcile payouts weekly.
  • Admin rights in the extranet for one person only.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

5Telephone system misused for international calls

Receipt

Hotel and accommodation

Tap a line for the reasoning

  • Telephone bill CHF 2'000–30'000 add-on

    AXA and Mobiliar as an add-on (Mobiliar max. 60 days of charges), Zurich 60 days within sub-limit 25%, Helvetia in the basic cover. How we got there: Helvetia sample case «several tens of thousands of francs»; lower limit an assumption.

  • Secure the telephone system CHF 360–1'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 2–6 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
CHF 360–1'400
Open or only with an add-on
CHF 2'000–30'000
Usually stays with the business
nothing

Likelihood low

Using a default password of the IP telephone system, perpetrators spend hours at the weekend calling expensive foreign numbers. At the end of the month, there is a bill for several thousand francs.

How it unfolds

Entry point: Telephone system with default password, open remote access

What AI changes: Hardly any AI connection; automated password guessing.

Why low? Helvetia lists phreaking as a sample case with «several tens of thousands of francs»; individual Swiss cases are not public.

Where does it say so?

Broschüre Cyber-Versicherung, 07.26 (Nr. 120015329)

Open document: Broschüre Cyber-Versicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • Change the default passwords of the telephone system.
  • Set a block on international calls and a cost limit with the provider.
  • Remote maintenance of the system only on request.
Pitfalls in the terms

Modules: Phone hacking and extra costs, Restore data and systems

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 8'340 Average revenue per day; your business may be smaller.

CHF 800–3'100 Annual premium for a micro business, indicative value based on the Helvetia rate, group B, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group B (among others, consulting, hotel, motor vehicle trade); this assignment is ours, not the insurer’s.

Indicative premiums for Hotel and accommodation per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

Real cases

  • Switzerland · 03.2024

    Hotels with a Booking.com account (anonymous)

    After booking via booking.com, guests received a message in the name of their hotel saying that the credit card had to be checked again.

  • Switzerland · 03.2025

    Hotels and their guests (anonymous)

    Attackers posed to hotels as guests with an unresolved problem and sent a link to a supposed booking.com portal.

  • Switzerland · 07.2024

    Hotel Waldstätterhof

    Via an old program, criminals hacked an external software provider of the hotel and captured guests’ email addresses and future stays.

6 more cases and sample cases

  • Switzerland · 09.2026

    Hotel Schweizerhof Lenzerheide

    Criminals stole booking data from a component of the hotel’s booking system and wrote to guests via WhatsApp.

  • Switzerland · 11.2018

    Hotel (anonymous)

    One evening, the manager of a hotel in the Zurich region opened a job application because the hotel was looking for staff at the time.

  • AustriaAbroad: Austria

    Accommodation business (anonymous)

    Unknown persons took over the Booking.com extranet access of an Austrian accommodation business and changed the bank details for payouts.

  • Italy · 2026Abroad: Italy

    Travellers and accommodation in Rome (accommodation not named)

    Perpetrators had taken over the Booking.com account of a real accommodation in Rome, changed the address and photos and asked guests to enter payment details via a link.

  • Austria · 01.2017Abroad: Austria

    Romantik Seehotel Jägerwirt

    In one of several attacks, ransomware paralysed the system for the room key cards; guests could no longer get into their rooms, and new cards could not be programmed.

  • Sample case from an insurer: Helvetia

    A hacker manipulates a company’s telephone system (phreaking); third parties constantly make expensive calls abroad, and at the end of the month a bill for several tens of thousands of francs arrives.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package». Amount only as an order of magnitude («several tens of thousands of francs»), hence chf null.

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 6/9, «Firmentelefonanlage manipuliert»

    «erhält das Unternehmen am Ende des Monats eine überraschend hohe Telefonrechnung von mehreren Zehntausend Franken.»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

Three ways forward