Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Agriculture: what can happen, and who pays?

limited 2 of 10 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Milking robot and barn climate disrupted” (likelihood medium).

As of

Agriculture5. Livestock dealer’s statement with a wrong IBAN52. Fake bank adviser with remote access24. Fake Twint QR code at the farm shop41. Milking robot and barn climate disrupted13. Ventilation control in the pig barn manipulated3

Livestock dealer’s statement with a wrong IBAN

Fake bank adviser with remote access

Fake Twint QR code at the farm shop

Milking robot and barn climate disrupted

Ventilation control in the pig barn manipulated

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Milking robot and barn climate disrupted
  2. Fake bank adviser with remote access
  3. Ventilation control in the pig barn manipulated
  4. Fake Twint QR code at the farm shop
  5. Livestock dealer’s statement with a wrong IBAN

1Milking robot and barn climate disrupted

Receipt

Agriculture

Tap a line for the reasoning

  • Vet, new computer (comparable case Zug) CHF 6'000–7'000 limited

    New computer only if cheaper than clean-up; vet costs are a consequence of damage to animals (property damage) and are excluded under cyber insurance. How we got there: Just under EUR 7'000 according to the Irish Examiner (including vet and new computer), converted around CHF 6'000–7'000 (exchange rate assumption).

  • Dead cow and calf no reliable figure not covered

    Property damage excluded; check livestock insurance (not evaluated). How we got there: Animal value not found.

  • Reset herd management, reconstruct data from the robot’s memory CHF 1'600–5'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 6–16 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Ransom (not paid) CHF 8'600 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Demanded: 10'000 US dollars, around CHF 8'600 (Zug 2023).

  • Additional effort for animal checks, milk loss CHF 430–1'500 limited

    Revenue per day derived from Agroscope income figures (around CHF 396'000 per farm); whether and how farms can be insured under SME cyber products was not checked. How we got there: 2–7 days × around CHF 1'080 revenue/day × 20% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 1'600–5'400
Open or only with an add-on
CHF 15'030–17'100
Usually stays with the business
1 item without an amount

Likelihood medium

Ransomware encrypts the PC to which the milking robot and herd management are connected; the perpetrators demand 10'000 dollars. The robots keep milking offline, but vital data, heat and insemination data are missing.

How it unfolds

An emergency with a pregnant cow is recognised too late; the calf dies and the cow has to be put down. At the same time, the ventilation control in the barn can no longer be reached.

Entry point: Herd management PC with internet access, without backup

What AI changes: AI helps perpetrators to find exposed control systems; in 2026, the NCSC reported an attack on a water supply in which AI suggested the targets.

Why medium? Real case in the canton of Zug (2023); in Canada, the same dairy farm twice. Around 3'000 Swiss farms milk with robots, more than half of new installations.

Where does it say so?

«Das Smartphone hat alles verändert» (Interview mit Thomas Anken, Agroscope), 31.07.2025, Interview

«3’000 Milchviehbetriebe in der Schweiz Melkroboter ein»

Open document: «Das Smartphone hat alles verändert» (Interview mit Thomas Anken, Agroscope) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Herd PC and robot in their own network, no email or browsing on this PC.
  • Back up herd data weekly to an external storage medium or with the robot manufacturer.
  • Emergency plan: observe animals manually, heat and insemination list on paper.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Control systems of machines and installations count as part of the IT system: forensics and restoration of the control software are covered (AXA E11; Zurich Art. 102.1 names medical, production and control technology).
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 102.1

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Replace unusable devices, Property damage caused by an attack, Restore data and systems, Cyber extortion, Loss of income after an attack

2Fake bank adviser with remote access

Receipt

Agriculture

Tap a line for the reasoning

  • Amount lost CHF 5'000–30'000 unclear

    Triggered by telephone: Helvetia excluded; the bank examines liability. How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 5'000–30'000
Usually stays with the business
nothing

Likelihood medium

A caller poses as the bank, has a remote maintenance app installed and triggers payments.

How it unfolds

Entry point: Telephone fraud

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? The NCSC describes fake bank employees with remote access.

What prevents it

  • The bank never calls about remote access.
  • Hang up and call back yourself.
  • Limits in e-banking.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Hacked e-banking

3Ventilation control in the pig barn manipulated

Receipt

Agriculture

Tap a line for the reasoning

  • Dead animals no reliable figure not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Animal values not found.

  • Reset the control system CHF 1'100–4'100 covered

    Control system = IT system. How we got there: 4–12 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

Usually paid by the cyber policy
CHF 1'100–4'100
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood low

Via the barn builder’s open remote access, perpetrators change temperature and ventilation settings. On a hot day the ventilation fails; animals die before the alarm is noticed.

How it unfolds

Entry point: Remote access to the barn control system

What AI changes: As above.

Why low? A manipulation of temperature and humidity in a grain silo is documented (Canada 2025); no case known for barn climate.

What prevents it

  • Alarm via an independent device (SMS) for temperature and power failure.
  • Remote access only on request.
  • Mechanical emergency ventilation.
Pitfalls in the terms

Modules: Property damage caused by an attack, Restore data and systems

4Fake Twint QR code at the farm shop

Receipt

Agriculture

Tap a line for the reasoning

  • Lost takings CHF 200–3'000 unclear

    No attack on the business’s IT system; not governed in any GTC reviewed. How we got there: Assumption: a few weeks of farm shop revenue.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 200–3'000
Usually stays with the business
nothing

Likelihood low

At the self-service farm shop, someone sticks their own QR code over the real one. For weeks, customers pay into the perpetrators’ account.

How it unfolds

Entry point: QR code physically pasted over

What AI changes: No AI connection.

Why low? Documented at parking meters, petrol stations and cash machines (Bern cantonal police 24.10.2026, Vaud); no case found at farm shops.

Where does it say so?

Kantonspolizei Bern warnt vor gefälschten Twint-QR-Codes an Parkuhren, 24.10.2026, nur über Suchergebnis gesehen

Open document: Kantonspolizei Bern warnt vor gefälschten Twint-QR-Codes an Parkuhren (opens in a new window), retrieved 06.11.2026

What prevents it

  • Check the QR code daily, check the Twint logo and name.
  • Use a dynamic QR code or a till.
  • Reconcile account receipts with sales weekly.
Pitfalls in the terms

Modules: Fraud with fake instructions

5Livestock dealer’s statement with a wrong IBAN

Receipt

Agriculture

Tap a line for the reasoning

  • Amount lost CHF 1'000–20'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'000–20'000
Usually stays with the business
nothing

Likelihood low

An email with the livestock dealer’s statement contains a new IBAN; the farmer pays the refund or expects a credit that never arrives.

How it unfolds

Entry point: Hacked email account of the dealer

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Invoice manipulation is widespread, but not documented in agriculture.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Call back when the IBAN changes.
  • Check statements in the portal.
  • Payment limits.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 1'080 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 11.2023

    Vital Bircher dairy farm

    In November 2023, ransomware encrypted the computer to which the milking robot of the farm with around 70 cows was connected; the perpetrators demanded 10'000 dollars (around 8'600 francs).

  • Switzerland · 09.2025

    Private individuals (anonymous)

    Victims received an email about a supposed tax refund and entered personal details, bank details and credit card data on a deceptively real website.

  • Switzerland · 02.2026

    Private individual (anonymous)

    Fraudsters called a victim as supposed NCSC employees and gained access to his mobile phone via remote access software.

5 more cases and sample cases

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • CanadaAbroad: Canada

    Dairy farm (anonymous)

    A dairy farm was hit twice by ransomware: after the first attack, it paid a ransom, and the team of researcher Ali Dehghantanha decrypted the systems and got the farm running again.

  • Mexico · 2026Abroad: Mexico

    Water supply (not named)

    At the beginning of 2026, unknown persons attacked a water supply in Mexico.

  • Canada · 10.2025Abroad: Canada

    Farm (anonymous)

    At the end of October 2025, the Canadian Centre for Cyber Security reported several interventions by hacktivists in freely accessible industrial control systems.

  • Kantonspolizei Bern warnt vor gefälschten Twint-QR-Codes an Parkuhren

    Where does it say so?

    Kantonspolizei Bern warnt vor gefälschten Twint-QR-Codes an Parkuhren, 24.10.2026, nur über Suchergebnis gesehen

    Open document: Kantonspolizei Bern warnt vor gefälschten Twint-QR-Codes an Parkuhren (opens in a new window), retrieved 06.11.2026

Three ways forward