Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Physiotherapy: what can happen, and who pays?

limited 7 of 12 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Email account hacked, spam to patients” (likelihood high).

As of

Physiotherapy3. Cloud appointment schedule gone after an attack on the provider3031. Email account hacked, spam to patients14. Ransomware on the practice server42. Report sent to the wrong health insurer25. Fake support call with remote access to e-banking5

Cloud appointment schedule gone after an attack on the provider

Email account hacked, spam to patients

Ransomware on the practice server

Report sent to the wrong health insurer

Fake support call with remote access to e-banking

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Email account hacked, spam to patients
  2. Report sent to the wrong health insurer
  3. Cloud appointment schedule gone after an attack on the provider
  4. Ransomware on the practice server
  5. Fake support call with remote access to e-banking

1Email account hacked, spam to patients

Receipt

Physiotherapy

Tap a line for the reasoning

  • Check the mailbox to see which data was viewed CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 500–2'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 2–8 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of patients by letter (postage only) CHF 200–2'400 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 200–2'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

Usually paid by the cyber policy
CHF 1'450–9'200
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood high

After a phishing attack, perpetrators send links from the practice’s email account to all contacts. There are doctors’ reports in the mailbox; it is unclear whether they were read.

How it unfolds

Entry point: Phishing of the email password

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why high? According to the NCSC, phishing is one of the most frequent reports (8'877 in the first half of 2026).

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login.
  • Send reports only via secure channels (e.g. HIN).
  • Archive old emails containing health data and delete them from the mailbox.
Pitfalls in the terms
  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Gross negligence (Art. 14 ICA): AXA (A13) and Helvetia (4.6.4) waive the reduction, Mobiliar and Zurich do not. The waiver does not help if an obligation (backup, patch, call-back) has been breached.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. A13, S. 11

    «Die AXA verzichtet auf das Recht der Leistungskürzung»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Inform affected people

2Report sent to the wrong health insurer

Receipt

Physiotherapy

Tap a line for the reasoning

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 500–2'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 2–8 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Compensation for non-material damage no reliable figure limited

    Zurich expressly; at AXA check in each individual case. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 500–2'800
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood high

A therapy report goes to the wrong insurer or person. The patient complains and demands compensation for non-material damage.

How it unfolds

Entry point: Operating error

What AI changes: No direct AI connection.

Why high? Everyday mistake; Zurich covers unintentional disclosure.

Where does it say so?

Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024

Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Check the recipient before sending (four-eyes principle for reports).
  • Secure transmission.
  • Template with patient ID in the subject line.
Pitfalls in the terms
  • Operating errors without an attack: AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover negligent errors by staff.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. E2, S. 16

    «Ein Cyber-Eigenschaden-Ereignis ist ein vorsätzlicher, schädigender Angriff durch Dritte oder durch versicherte Personen»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Third-party claims after a data breach

3Cloud appointment schedule gone after an attack on the provider

Receipt

Physiotherapy

Tap a line for the reasoning

  • Cancelled therapy sessions CHF 2'600–3'900 limited

    SFTA value for physiotherapy with little informative value (medical treatment exempt from VAT). How we got there: 2–3 days × around CHF 3'290 revenue/day × 40% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 2'600–3'900
Usually stays with the business
nothing

Likelihood medium

After an attack, the provider of the practice software has to shut down the platform. For three days, nobody knows which patients are coming when; therapy sessions are cancelled, and billing piles up.

How it unfolds

Entry point: Attack on the software provider

What AI changes: No direct AI connection.

Why medium? Attacks on Swiss software providers in the healthcare sector documented (Cistec).

What prevents it

  • Back up the weekly schedule daily as a PDF.
  • Patient telephone list offline.
  • Ask the provider about its emergency process.
Pitfalls in the terms

Modules: Outage at the IT provider

4Ransomware on the practice server

Receipt

Physiotherapy

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'500–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 6–20 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 1'800–6'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 10–30 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Resetting the workstations (PCs, tablets) CHF 360–4'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 2–5 devices × CHF 180–800 per device

  • Reconstruction of lost reports CHF 1'000–6'000 limited

    Without a usable backup, insurers reduce the benefit (AXA C5: only costs of establishing the loss). How we got there: Assumption: re-entry by staff.

  • Loss of revenue CHF 3'300–8'200 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 2–5 days × around CHF 3'290 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 3'660–18'800
Open or only with an add-on
CHF 4'300–14'200
Usually stays with the business
nothing

Likelihood medium

Via a remote maintenance access with a weak password, perpetrators encrypt the small practice server with reports and prescriptions. The backup is on a connected hard disk and is also encrypted.

How it unfolds

Entry point: Remote maintenance with a weak password

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Ransomware against small practices has been documented several times abroad; no public Swiss physiotherapy case.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Disconnect the backup hard disk after the backup, or use a cloud backup with versioning.
  • Remote maintenance only with two-factor login.
  • Automatic updates.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

  • Patch deadline: close critical vulnerabilities within 30 days (AXA C2, Zurich Art. 6, Helvetia 3.6.1.1), at Mobiliar within 14 days; Mobiliar excludes losses caused by software without manufacturer support (E let. n).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Teil D Ziff. 5, S. 21

    «Sie müssen den Patch zur Behebung der kritischen Schwachstelle innerhalb von 14 Tagen nach der Veröffentlichung»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack

5Fake support call with remote access to e-banking

Receipt

Physiotherapy

Tap a line for the reasoning

  • Amount lost CHF 5'000–30'000 unclear

    If the practice owner approved the payment herself, it counts as social engineering by telephone: Helvetia excluded, Zurich/Mobiliar only written online orders, AXA A6 with add-on. How we got there: Assumption.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 5'000–30'000
Usually stays with the business
nothing

Likelihood medium

A supposed bank employee calls, warns of a suspicious payment and has remote maintenance software installed. During the conversation, a payment of CHF 15'000 is triggered.

How it unfolds

Entry point: Telephone fraud with remote access

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? The NCSC describes fake bank employees with remote access; affects private individuals and small businesses.

What prevents it

  • The bank never calls and never asks for remote access: hang up and call back yourself.
  • E-banking limits.
  • No remote maintenance software on the instructions of unknown persons.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Hacked e-banking

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 3'290 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: weak.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

  • Practice software with appointment scheduling and billing, often as a cloud solution Common in the sector, no source.
  • Online appointment booking
  • Email with reports to doctors and insurers
  • Card terminal, Twint, e-banking

Real cases

  • Switzerland · 09.2023

    Wedding planner (anonymous)

    Comparison: phishing via a fake customer enquiry.

  • Switzerland · 2025

    Cistec

    In the first half of 2025, a ransomware attack hit Cistec, a Swiss manufacturer of clinical information systems.

  • Switzerland · 09.2025

    Private individuals (anonymous)

    Victims received an email about a supposed tax refund and entered personal details, bank details and credit card data on a deceptively real website.

2 more cases and sample cases

Three ways forward