Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Butcher’s shop: what can happen, and who pays?

limited 10 of 20 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. Since October 2026, attackers in several European countries have been manipulating refrigeration systems via the internet.

Who pays for spoiled goods after an attack

As of

Butcher’s shop3. Fake invoice from the livestock dealer35. Customer data stolen from the party catering shop52. Server encrypted, scales without prices, deliveries delayed24. Card terminal and Twint fail on Saturday morning41. Refrigeration system manipulated, goods spoiled1

Fake invoice from the livestock dealer

Customer data stolen from the party catering shop

Server encrypted, scales without prices, deliveries delayed

Card terminal and Twint fail on Saturday morning

Refrigeration system manipulated, goods spoiled

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Refrigeration system manipulated, goods spoiled
  2. Server encrypted, scales without prices, deliveries delayed
  3. Fake invoice from the livestock dealer
  4. Card terminal and Twint fail on Saturday morning
  5. Customer data stolen from the party catering shop

1Refrigeration system manipulated, goods spoiled

Receipt

Butcher’s shop

Tap a line for the reasoning

  • Spoiled goods (cold room of a butcher’s shop) CHF 20'000–60'000 not covered

    Cyber insurance does not pay for the goods (property damage). Property insurance pays for refrigerated goods only in the event of a technical defect or power interruption; manipulation by hackers is excluded there or unclear. The loss is likely to remain with the business. How we got there: A value of goods of CHF 40'000 is documented for the cold room of a butcher’s shop (Zurich property factsheet, technical defect). Range as an assumption based on 4–11 sales days of stock coverage × around CHF 5'340 revenue/day (SFTA 2024), not documented; cross-check: CHF 40'000 corresponds to 2.5–12.5 t carcass weight at SBV producer prices (pork 3.20, veal 15.80 francs/kg carcass weight, week 23/2026).

  • Disposal of the goods (animal by-products) no reliable figure not covered

    Consequential costs of the property damage; excluded under cyber insurance. How we got there: No public rate found.

  • Refrigeration technician or IT emergency: reset the control system, reconfigure it, check defrost schedules CHF 1'100–4'100 covered

    Control systems count as IT systems (AXA E11, Zurich Art. 102.1): restoration covered. Hourly rate of the refrigeration technician not found, estimated here at the IT emergency rate (assumption). How we got there: 4–12 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • IT forensics: find the point of entry, check other devices, secure remote access CHF 1'000–6'400 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 4–16 h × CHF 250–400/h (market range for incident response)

  • Replacement of a control unit without security updates (end of life) no reliable figure limited

    Hardware replacement only if cheaper than clean-up; replacement because the old device is insecure is an improvement and usually not covered (Helvetia 3.3.1.9 let. a: improvements). How we got there: Device price not found. CERT-FR: for devices without updates, a reset is not enough.

  • Loss of revenue while goods are missing CHF 2'700–8'000 not covered

    If the outage results from the spoiled goods, it is the consequence of property damage: AXA B6 and Helvetia 3.2.3 b exclude it. For an outage caused solely by a blocked control system, the situation is unclear. How we got there: 1–3 days × around CHF 5'340 revenue/day × 50% (assumption: partial range) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 22'700–68'000

Usually paid by the cyber policy
CHF 2'100–10'500
Open or only with an add-on
1 item without an amount
Usually stays with the business
plus 1 item without an amount

Likelihood medium

During the night before Monday, an attacker logs in via the refrigeration control system’s remote maintenance, which is accessible from the internet, and switches the cold rooms to defrost mode. By the time the butcher arrives in the morning, it is over 20 degrees in the cold rooms; meat, sausages and semi-finished products have to be disposed of.

How it unfolds

The refrigeration technician resets the control system, and an IT specialist checks whether other devices are affected. For two days there is only a reduced range of products.

Entry point: Remote maintenance access to the refrigeration control system directly on the internet, default password or device without security updates

What AI changes: The attackers search for open control systems automatically; AI helps with evaluating manuals and default passwords. The wave shows that simple tools are enough; AI makes mass scanning cheaper.

Why medium? Wave of attacks documented since October 2026 in France (more than 230 supermarkets), Belgium, Sweden and Germany, including two butcher’s shops; in France the temperature rose to as much as 50 degrees. No case is known from Switzerland as of 06.11.2026. Older control systems without updates and with open remote access are particularly at risk.

Where does it say so?

CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

«Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

Where does it say so?

French supermarket cyberattack triggers wider security alert, 14.10.2026, Abschnitt Intermarché (nach Le Monde)

«a cold room reached 50°C before the damage was discovered»

Open document: French supermarket cyberattack triggers wider security alert (opens in a new window), retrieved 06.11.2026

What prevents it

  • Do not operate the refrigeration control system directly on the internet; remote maintenance only via VPN with two-factor login, change default passwords (ask the refrigeration technician).
  • Fit an independent temperature sensor with SMS alarm to every cold room; alarm also at night and at weekends.
  • Clarify with the adviser whether refrigerated goods are insured after a hacker attack (compare the property and cyber policies side by side); have any gap confirmed in writing.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Property insurance usually does not help: refrigerated goods are insured there only as an add-on and only in the event of a technical defect or power interruption (AXA property B8, Allianz C6.3.3); AXA excludes operating errors (B8.5) and, in the catch-all provision, hacker attacks (let. s), Mobiliar All Risks excludes cyber risks (section 3).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung, Ausgabe 06.2024 (16373DE – 2024-06), Nicht genannte Gefahren, lit. s

    «Schäden verursacht durch Schadprogramme, Hacker- und Denial-of-Service-Angriffe sowie andere Cyber-Ereignisse.»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung (opens in a new window), retrieved 06.11.2026

  • CERT-FR advises checking the insurance conditions before disconnecting remote monitoring: some refrigerated goods covers require alarm transmission.
    Where does it say so?

    CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

    «Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

    Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Property damage caused by an attack, Restore data and systems, Immediate help in an emergency, Replace unusable devices, Loss of income after an attack

2Server encrypted, scales without prices, deliveries delayed

Receipt

Butcher’s shop

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'000–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 8–30 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 5'400–20'300 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Resetting the workstations (PCs, tablets) CHF 540–6'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 3–8 devices × CHF 180–800 per device

  • Re-entering delivery notes, order quantities and reports (own staff) CHF 3'000–8'000 unclear

    AXA reimburses re-entry of the last 7 days (A1.1.3); older data without a backup only at a reduced rate. Internal working time is recognised differently depending on the insurer. How we got there: More than 100 hours of additional effort in the Wechsler case × assumed CHF 30–80 internal costs/h (not documented).

  • Loss of revenue due to delayed deliveries and shop operation without scales CHF 1'600–3'200 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 1–2 days × around CHF 5'340 revenue/day × 30% (assumption: partial outage) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Ransom (not recommended) no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: No Swiss average found; in the comparable construction case of 2016 around CHF 2'000 (V-CH-2016-001).

Usually paid by the cyber policy
CHF 7'940–38'700
Open or only with an add-on
CHF 4'600–11'200, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

Through an unprotected point in the router, an attacker introduces ransomware that encrypts the server with merchandise management, delivery notes and work reports. Because the labelling scales are connected to the same system, they no longer know any prices; delivery to restaurants is delayed by hours.

How it unfolds

The last backup is two weeks old, and delivery notes and order quantities have to be re-entered by hand.

Entry point: Router or remote access with a known vulnerability; alternatively an email attachment

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? The NCSC counts around 80 ransomware incidents at Swiss organisations per half-year; 6% of SMEs had a serious incident in three years (Mobiliar study 2026). The Wechsler case is a real Swiss butcher’s shop case.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

Where does it say so?

«KMU Cybersicherheit 2026» (Medienmitteilung; n=507 KMU), 22.10.2026

Open document: «KMU Cybersicherheit 2026» (Medienmitteilung; n=507 KMU) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Separate scales, till and refrigeration into their own network so that an encrypted server does not paralyse the shop.
  • Daily backup with one copy offline; test restoring once a quarter.
  • Have the IT partner check the router and remote access; automatic updates.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Cyber extortion

3Fake invoice from the livestock dealer

Receipt

Butcher’s shop

Tap a line for the reasoning

  • Invoices transferred to the wrong account CHF 5'000–40'000 add-on

    Only with the social engineering add-on; the call-back to the dealer on the known number must be documented. Mobiliar does not pay for evidently forged invoices. How we got there: Assumption: one to two weekly invoices from a livestock dealer; no sector source.

  • Check whether the business’s own mailbox is also affected CHF 500–2'400 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 2–6 h × CHF 250–400/h (market range for incident response)

  • Claim by the real dealer no reliable figure unclear

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Same amount as above. The real dealer still demands their money; whether the butcher’s shop has to pay again is a legal question (no Swiss source evaluated).

Usually paid by the cyber policy
CHF 500–2'400
Open or only with an add-on
CHF 5'000–40'000, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

The accounts department receives an email from the familiar livestock dealer: the bank has changed, please pay the next invoice into a new account. The email comes from the dealer’s hacked mailbox and refers to real deliveries.

How it unfolds

The butcher’s shop pays two invoices into the wrong account; the dealer sends a reminder three weeks later.

Entry point: Hacked email account of a supplier (business email compromise)

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? NCSC: 132 reports of invoice manipulation in 2025, largest individual loss mentioned CHF 1.5 million; the number of unreported cases is high, because mainly companies that suffered a loss report.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

Where does it say so?

Halbjahresbericht 2025/II (Juli–Dezember), 30.03.2026

Open document: Halbjahresbericht 2025/II (Juli–Dezember) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Never accept new bank details by email: call back on the known number, file a note with date and name.
  • Four-eyes principle for new payees in e-banking.
  • Fix suppliers’ IBANs in the creditor list and have changes reported.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Mobiliar does not pay if a payment request was evidently forged or not personalised, or concerns goods that were never ordered (B8.2 let. c).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.2 lit. c

    «weil Sie frei erfundene oder erkennbar gefälschte Zahlungsaufforderungen bezahlt haben»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

4Card terminal and Twint fail on Saturday morning

Receipt

Butcher’s shop

Tap a line for the reasoning

  • Loss of revenue for 3–6 hours CHF 200–400 not covered

    An outage of infrastructure (telecoms, payment network) is excluded in all cyber GTC reviewed; in addition, it is shorter than the waiting period of 12–24 hours. How we got there: 3–6 hours (⅛–¼ day) × around CHF 5'340 revenue/day (SFTA 2024) × 30% (assumption: cash payers keep buying)

Usually stays with the businessCHF 200–400

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood low

A large DDoS attack on a telecoms or payment provider paralyses Twint and card payments over lunchtime. Customers can only pay in cash, and some leave without buying.

How it unfolds

After three hours everything works again; the business itself was not attacked.

Entry point: Attack on a third party (network or payment service provider)

What AI changes: AI hardly plays a role here; DDoS capacity is rented.

Why low? The DDoS attack on Swisscom on 23.08.2024 with a temporary outage of Twint and card payments is documented; such outages are rare and usually last hours.

What prevents it

  • Keep an emergency cash float and a «cash only» sign ready.
  • Check a second payment channel (another terminal provider or mobile network backup).
  • Set up the till so that it keeps selling offline.
Pitfalls in the terms

Modules: Outage at the IT provider

5Customer data stolen from the party catering shop

Receipt

Butcher’s shop

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'000–9'600 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 8–24 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–5'200 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–15 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 1'000–6'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–5'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Claims by affected customers no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No Swiss amounts found.

Usually paid by the cyber policy
CHF 4'200–20'800, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood low

The small webshop for party catering runs on an outdated plugin. Attackers copy the names, addresses, telephone numbers and order history of several thousand customers and then send phishing text messages in the name of the butcher’s shop.

How it unfolds

The butcher’s shop has to inform its customers and report to the FDPIC.

Entry point: Outdated shop plugin or weak admin password

What AI changes: AI makes it easier to find vulnerable plugins and to write credible phishing text messages with real order data.

Why low? Data leaks at small shops are documented (e.g. dvd-shop.ch), but no case is known for butcher’s shops.

What prevents it

  • Run the shop with the provider as software-as-a-service instead of a self-hosted system with plugins.
  • Store only necessary data; delete old orders.
  • Admin access with two-factor login.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 5'340 Average revenue per day; your business may be smaller.

CHF 700–1'600 Annual premium for a micro business, indicative value based on the Helvetia rate, group C, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group C (among others, retail, food production, metal goods, doctors, lawyers); this assignment is ours, not the insurer’s.

Indicative premiums for Butcher’s shop per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 700–1'600Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, butcher’s shop/retail/food production (Helvetia Group C, assignment of butcher’s shop derived)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote. Butcher’s shop is not named literally in the application; Group C via «retail» and «manufacture of food».

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 1'100–2'800Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group C (retail, food, metal goods/CNC)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

  • Cold room and freezer control with remote maintenance by the refrigeration technician (e.g. Danfoss AK-SM/AK-SC, Copeland/Dixell xweb) These device series were affected in the wave of attacks from 12.10.2026.
    Source

    CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

    «Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

    Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

  • Labelling and shop scales connected to the merchandise management server At Metzgerei Wechsler, the scales no longer knew any prices after the attack. Documented case: Metzgerei Wechsler
  • Till and card terminal, Twint Common in the sector, no specific source.
  • Order and delivery note system for catering and reseller customers Documented case: Metzgerei Wechsler
  • Email, e-banking, accounting Common in the sector, no specific source.
  • Webshop or order form for party catering Assumption, no source.

Real cases

  • Switzerland · 10.2018

    Metzgerei Wechsler

    Metzgerei Wechsler, Nebikon: costs of around CHF 20'000, more than 100 hours of re-entry.

  • Switzerland · 01.2023

    Company (anonymous)

    Swiss case: fake QR-bill with a Swiss account, hard to spot.

  • Switzerland · 08.2024

    Swisscom

    DDoS on Swisscom 2024: Twint, mobile payment and e-banking temporarily restricted.

7 more cases and sample cases

  • Switzerland · 12.2017

    dvd-shop.ch

    dvd-shop.ch: around 70'000 sets of login data leaked.

  • Germany · 2026Abroad: Germany

    Butcher’s shop (anonymous)

    Butcher’s shop in the Upper Palatinate: cold stores set to as much as 150 degrees, discovered in time, five-figure loss in euros.

  • Belgium · 10.2026Abroad: Belgium

    De Laet en Van Haver

    Belgian butcher’s chain De Laet en Van Haver with attacked refrigeration units.

  • France · 10.2026Abroad: France

    Intermarché, Coopérative U, Carrefour (more than 230 branches)

    During the night before 12 October 2026, attackers switched the refrigeration and freezer systems of around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops to defrost mode; for around six hours the temperature rose to as much as 50 degrees.

  • Belgium · 10.2026Abroad: Belgium

    Delhaize, Carrefour, Spar (around 60 branches)

    Belgium: food worth around 100'000 euros destroyed.

  • Sample case from a property insurer, for comparison: Zurich

    Value of goods CHF 40'000 in the event of a technical defect; property insurance pays. Total according to the insurer: CHF 40'000.

    Distinction, not cyber: Zurich pays for the spoilage of goods from the property insurance because there is a technical defect. If hackers manipulate the refrigeration control system, the cyber GTC reviewed exclude the property damage; whether the property insurance pays is an open question (see versicherer-geschaeft.json, abgrenzung). Useful as an order of magnitude for refrigerated goods at a butcher’s shop.

    Where does it say so?

    Factsheet Zurich Sachversicherung, ZH21646d-2301, Schadenbeispiele, Warenverderb

    «Aufgrund eines technischen Defekts an der Kühlanlage steigt die Temperatur im Kühlraum einer Metzgerei auf 20 Grad.»

    Open document: Factsheet Zurich Sachversicherung (opens in a new window), retrieved 06.11.2026

  • Real case, published by the insurer

    Metzgerei Wechsler, Nebikon LU (4 branches, 50 employees), October 2018: a Trojan enters through an unprotected point in the router and encrypts the server; the labelling scales no longer know any prices, and delivery is delayed from 7 to 10 a.m. Last backup two weeks old. Total according to the insurer: CHF 20'000.

    Real case with total costs, but without any mention of insurance and without a breakdown. Publisher not reliably documented. Corresponds to incident V-CH-2018-001 of the incident research. Refrigeration was not affected. Insurer not named; the earlier attribution to Mobiliar is based only on the file name of the source (MOB_01_EPIC).

    Where does it say so?

    Metzger Wechsler und die Hacker (Dossier Cyber-Attacken), 2019 (Vorfall Oktober 2018), S. 6–7 und 10–11

    «Kosten des Vorfalls: rund 20 000 Franken.»

    Open document: Metzger Wechsler und die Hacker (Dossier Cyber-Attacken) (opens in a new window), retrieved 06.11.2026

Three ways forward