Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Property management: what can happen, and who pays?

limited 6 of 11 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Tenant data encrypted and copied” (likelihood medium).

As of

Property management2. Tenants receive letters with a new IBAN23. Fake tradesperson’s invoice31. Tenant data encrypted and copied15. The provider’s property management software fails54. Heating of a housing development switched off via remote access4

Tenants receive letters with a new IBAN

Fake tradesperson’s invoice

Tenant data encrypted and copied

The provider’s property management software fails

Heating of a housing development switched off via remote access

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Tenant data encrypted and copied
  2. Tenants receive letters with a new IBAN
  3. Fake tradesperson’s invoice
  4. Heating of a housing development switched off via remote access
  5. The provider’s property management software fails

1Tenant data encrypted and copied

Receipt

Property management

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 3'800–20'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 15–50 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of tenants by letter (postage only) CHF 1'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Loss of revenue CHF 4'500–11'200 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 2–5 days × around CHF 7'500 revenue/day × 30% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 10'900–56'000
Open or only with an add-on
CHF 4'500–11'200
Usually stays with the business
nothing

Likelihood medium

Ransomware encrypts the property management software; the perpetrators copy rental agreements, salary statements and debt collection extracts of prospective tenants and threaten to publish them.

How it unfolds

Entry point: Phishing or remote access

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Ransomware with data theft is standard; property managers hold a lot of sensitive personal data.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Delete the files of rejected applicants.
  • Two-factor login.
  • Offline backup.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Inform affected people, Loss of income after an attack

2Tenants receive letters with a new IBAN

Receipt

Property management

Tap a line for the reasoning

  • Misdirected rent payments CHF 5'000–50'000 not covered

    The tenants’ money; only Helvetia 3.3.1.8 let. b in the case of manipulation on the business’s own system. How we got there: Assumption: 5–30 tenants × one month’s rent.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–12 h × CHF 250–400/h (market range for incident response)

Usually stays with the businessCHF 5'000–50'000

Usually paid by the cyber policy
CHF 750–4'800
Open or only with an add-on
nothing

Likelihood medium

In the name of the property manager, perpetrators send emails to tenants with new bank details for rent. Several tenants pay one month’s rent to the fraudsters.

How it unfolds

Entry point: Hacked email account or similar domain

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Similar domains and forwarding rules described by the NCSC.

What prevents it

  • Inform tenants: IBAN changes only by post with a signature.
  • Register similar domains.
  • Two-factor login.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

3Fake tradesperson’s invoice

Receipt

Property management

Tap a line for the reasoning

  • Amount transferred CHF 5'000–50'000 add-on

    Entrusted funds (owners’ account): Zurich only in the case of legal liability. How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 5'000–50'000
Usually stays with the business
nothing

Likelihood medium

An invoice with a new IBAN comes from a tradesperson’s hacked mailbox; the property manager pays from the owners’ account.

How it unfolds

Entry point: Hacked email account of the tradesperson

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Invoice manipulation is widespread.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Call back when the IBAN changes.
  • Four-eyes principle.
  • Lock the creditor master data.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Heating of a housing development switched off via remote access

Receipt

Property management

Tap a line for the reasoning

  • Technician: reset the control system CHF 1'100–4'100 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 4–12 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Rent reduction, frost damage no reliable figure not covered

    Frost damage is property damage; a rent reduction is more a loss of income for the owner. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 1'100–4'100
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood low

The building management system of a housing development can be reached via remote maintenance. In January, unknown persons switch off the heating; tenants demand a rent reduction, and pipes are at risk of freezing.

How it unfolds

Entry point: Open building management system

What AI changes: Mass scans for open control systems.

Why low? The Cyber-Defence Campus is investigating the security of building automation; attacks on refrigeration and heating control systems documented in Europe in 2026.

Where does it say so?

Exploring security for building automation and control systems, abgerufen 06.11.2026, nur über Suchergebnis gesehen

Open document: Exploring security for building automation and control systems (opens in a new window), retrieved 06.11.2026

Where does it say so?

CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

«Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

What prevents it

  • Building services not directly on the internet.
  • Remote maintenance via VPN.
  • Fault alerts to the caretaker.
Pitfalls in the terms

Modules: Restore data and systems, Property damage caused by an attack

5The provider’s property management software fails

Receipt

Property management

Tap a line for the reasoning

  • Additional work and delays CHF 4'500–7'500 limited

    Only if the service provider’s system was attacked, and usually with a written contract (Mobiliar, Zurich); purely technical outages and network outages are not covered. How we got there: 3–5 days × around CHF 7'500 revenue/day × 20% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 4'500–7'500
Usually stays with the business
nothing

Likelihood low

The cloud provider of the property management software is offline for a week after an attack; statements are delayed.

How it unfolds

Entry point: Attack on the provider

What AI changes: No direct AI connection.

Why low? Supply chain attacks documented in Switzerland.

What prevents it

  • Data export.
  • Emergency process.
  • Check the contract.
Pitfalls in the terms

Modules: Outage at the IT provider

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 7'500 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 10.2025

    Around 200 companies in Switzerland (anonymous)

    Between May 2023 and September 2025, the Akira group attacked around 200 companies in Switzerland with ransomware, most recently four to five cases a week.

  • Switzerland · 12.2024

    Company (anonymous)

    After a phishing attack on a business email account, attackers set up forwarding rules and registered similar-looking domains ending in «.cam» for the company and several customers.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

2 more cases and sample cases

  • Switzerland · 05.2023

    Unico Data AG

    In May 2023, the group «Play» attacked the provider of IT solutions for SMEs; most services were then offline.

  • France · 10.2026Abroad: France

    Intermarché, Coopérative U, Carrefour (more than 230 branches)

    During the night before 12 October 2026, attackers switched the refrigeration and freezer systems of around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops to defrost mode; for around six hours the temperature rose to as much as 50 degrees.

Three ways forward