Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Online shop: what can happen, and who pays?

limited 7 of 16 cost items usually covered

6 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Orders with a stolen identity” (likelihood high).

As of

Online shop3. Shop paralysed for twelve hours by a flood of requests31. Card data stolen in the shop (skimming)16. The provider’s shop platform fails64. Extortionists threaten to publish customer data45. Fake copy of the shop52. Orders with a stolen identity2

Shop paralysed for twelve hours by a flood of requests

Card data stolen in the shop (skimming)

The provider’s shop platform fails

Extortionists threaten to publish customer data

Fake copy of the shop

Orders with a stolen identity

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

6 scenarios, 6 receipts

  1. Card data stolen in the shop (skimming)
  2. Orders with a stolen identity
  3. Shop paralysed for twelve hours by a flood of requests
  4. Extortionists threaten to publish customer data
  5. Fake copy of the shop
  6. The provider’s shop platform fails

1Card data stolen in the shop (skimming)

Receipt

Online shop

Tap a line for the reasoning

  • Forensics according to card industry requirements, clean-up CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 1'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Penalties and card replacement costs of the card industry (PCI) no reliable figure limited

    Zurich and Helvetia pay PCI penalties, where insurable; Mobiliar only as an add-on with valid PCI certification; AXA excludes them (B4, B11). How we got there: No Swiss amounts found.

  • Claims by customers no reliable figure covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: No amounts found.

  • Loss of revenue while the shop is offline CHF 23'100–77'000 limited

    SFTA value for online retail with little informative value (large providers distort it); small shops are far lower. How we got there: 3–10 days × around CHF 15'410 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 8'500–54'500, plus 1 item without an amount
Open or only with an add-on
CHF 23'100–77'000, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

Via an outdated plugin, attackers inject a script into the payment page. Customers see a genuine-looking card form; the data goes to a domain with an almost identical name.

How it unfolds

After three weeks, the payment provider reports an accumulation of card misuse, the shop has to go offline, and a forensic investigation according to card industry requirements is mandatory.

Entry point: Outdated plugin, compromised third-party script or admin access

What AI changes: AI builds flawless copies of payment forms in all languages and helps to disguise scripts.

Why medium? Documented at the ESA shop (2024) and at a Swiss food delivery webshop (2026).

What prevents it

  • Use the payment provider’s hosted payment page; no card data in your own shop.
  • Keep plugins to a minimum and update them automatically; admin access with two-factor login.
  • Integrity monitoring of the payment page (notification of script changes).
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Card industry penalties, Third-party claims after a data breach, Loss of income after an attack

2Orders with a stolen identity

Receipt

Online shop

Tap a line for the reasoning

  • Unpaid goods CHF 1'000–20'000 limited

    Expressly only Helvetia (3.3.1.8 let. c, sub-limit, criminal complaint). How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'000–20'000
Usually stays with the business
nothing

Likelihood high

Perpetrators order on invoice using the real names and addresses of other people and have the goods delivered to parcel lockers. The invoices remain unpaid.

How it unfolds

Entry point: Fake identity fraud

What AI changes: AI helps with creating accounts on a large scale.

Why high? FSO: more than 20'000 cases of misuse of online payment systems or someone else’s identity in 2025.

Where does it say so?

Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500), 23.03.2026

Open document: Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Purchase on invoice only with credit and address checks.
  • Delivery to parcel lockers for new customers only against advance payment.
  • Block conspicuous order patterns.
Pitfalls in the terms

Modules: Fraud with fake instructions

3Shop paralysed for twelve hours by a flood of requests

Receipt

Online shop

Tap a line for the reasoning

  • Loss of revenue CHF 3'900–23'100 limited

    With a 12 h outage, everything falls within the waiting period (AXA, Mobiliar 12 h; Helvetia 24 h). How we got there: ½–3 days × around CHF 15'410 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Defence measures CHF 540–2'200 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 3–10 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 4'440–25'300
Usually stays with the business
nothing

Likelihood medium

A flood of requests paralyses the website for twelve hours; orders are lost.

How it unfolds

Entry point: DDoS

What AI changes: Hardly any AI connection.

Why medium? Mobiliar sample case (12 hours), AXA (3 days).

What prevents it

  • DDoS protection at the hosting provider/CDN.
  • Static emergency page.
  • Choose the waiting period consciously with the insurer.
Pitfalls in the terms

Modules: Loss of income after an attack

4Extortionists threaten to publish customer data

Receipt

Online shop

Tap a line for the reasoning

  • Check whether and where the data comes from CHF 2'500–12'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–5'200 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–15 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of customers by letter (postage only) CHF 1'000–24'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–20'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Ransom CHF 3'000 limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Documented: around CHF 3'000 demanded (2017).

Usually paid by the cyber policy
CHF 4'700–41'200
Open or only with an add-on
CHF 3'000
Usually stays with the business
nothing

Likelihood medium

A group claims to have the entire customer database, encloses a sample and demands Bitcoin within three days.

How it unfolds

Entry point: Data leak (origin often unclear)

What AI changes: AI makes it easier to evaluate and resell the data.

Why medium? Documented at Swiss shops (2017); leaks of login data are frequent.

What prevents it

  • Store passwords only in hashed form.
  • Delete old customer accounts.
  • Secure admin access.
Pitfalls in the terms
  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Inform affected people, Cyber extortion

5Fake copy of the shop

Receipt

Online shop

Tap a line for the reasoning

  • Domain block, defence CHF 1'200–7'000 unclear

    No attack on the business’s own system; usually not an insured event. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Reputational damage no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'200–7'000
Usually stays with the business
1 item without an amount

Likelihood medium

Fraudsters copy the shop onto a similar domain, sell against advance payment and never deliver. Victims contact the real shop.

How it unfolds

Entry point: Misuse of name and design

What AI changes: AI creates shop copies and product texts in minutes.

Why medium? According to FSO crime statistics, fake shops are widespread; copy of a real shop documented (watchmaker DE 2026).

Where does it say so?

Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500), 23.03.2026

Open document: Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Register similar domains yourself.
  • Trademark monitoring.
  • Warning notice on the website.
Pitfalls in the terms

Modules: Media liability, Reputational damage

6The provider’s shop platform fails

Receipt

Online shop

Tap a line for the reasoning

  • Loss of revenue CHF 7'700–15'400 limited

    Only in the event of an attack on the provider; technical outage not insured. How we got there: 1–2 days × around CHF 15'410 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 7'700–15'400
Usually stays with the business
nothing

Likelihood low

The provider’s shop software-as-a-service is offline for two days after an attack.

How it unfolds

Entry point: Attack on the provider

What AI changes: No direct AI connection.

Why low? Large platforms are well protected; outages tend to be technical.

What prevents it

  • Status page and emergency communication.
  • Contract on availability.
  • Be able to take orders by telephone.
Pitfalls in the terms

Modules: Outage at the IT provider

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 15'410 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: weak.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 08.2026

    Food delivery webshop (anonymous)

    Attackers injected malicious code into the genuine payment page of a webshop for food orders.

  • Switzerland · 02.2017

    Swiss online shop (anonymous)

    The group «Armada Collective» claimed to have the entire customer database of a Swiss online shop and enclosed a data record as proof.

  • Switzerland · 12.2017

    dvd-shop.ch

    The federal government received around 70'000 stolen combinations of username and password; MELANI attributed them to the online shop dvd-shop.ch. The operator reset all passwords, took the shop offline temporarily and informed customers by email.

6 more cases and sample cases

  • international · 12.2024Abroad: international

    Official online shop of the European Space Agency ESA

    Shortly before Christmas 2024, the company Sansec discovered a script in the ESA shop that showed a fake payment page at checkout and captured card data.

  • Germany · 02.2026Abroad: Germany

    Master watchmaker Peter-Jesko Buse

    At the end of February 2026, a supposed customer asked about a watch that the 83-year-old master watchmaker had never sold.

  • Sample case from an insurer: Mobiliar

    A flood of requests paralyses an online shop’s website for 12 hours; loss of income.

    Sample case without an amount. Lies exactly at the 12-hour waiting period: shorter outages are borne by the business itself.

    Where does it say so?

    Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele), abgerufen 06.11.2026, Schadenbeispiele, Ertragsausfall «Server lahmgelegt»

    Open document: Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele) (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: AXA

    Outdoor clothing specialist with its own webshop: a DoS attack blocks the system, and the webshop is down for three days.

    Sample case; amount only as an order of magnitude («several thousand francs»), hence chf null. AXA waiting period 12 hours.

    Where does it say so?

    Factsheet Cyberversicherung Unternehmen, 14152DE – 2025-10, Ziff. 5, Ertragsausfall

    «Die AXA übernimmt den Ertragsausfall von mehreren tausend Franken.»

    Open document: Factsheet Cyberversicherung Unternehmen (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Helvetia

    DoS attack on the online shop of a specialist shoe shop during the Christmas period; repelled after a few days with the help of an IT specialist, with loss of profit until then.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package». Helvetia BI waiting period 24 hours (KMU-Spezial application).

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 7/9, «Online-Shop lahmgelegt»

    «Bis zur Installation der Abwehrmassnahmen entsteht während der ertragsreichen Weihnachtszeit dennoch ein Gewinnausfall für das Schuhfachgeschäft.»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

  • Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500)

    Where does it say so?

    Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500), 23.03.2026

    Open document: Polizeiliche Kriminalstatistik (PKS), Jahresbericht 2025 (BFS-Nr. 1116-2500) (opens in a new window), retrieved 06.11.2026

Three ways forward