Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Production and industrial SMEs: what can happen, and who pays?

limited 9 of 19 cost items usually covered

6 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “ERP encrypted, production at a standstill for a month” (likelihood medium).

As of

Production4. Owner transfers millions after AI call46. Large order from a sham company61. ERP encrypted, production at a standstill for a month13. Design data stolen35. Machine parameters changed, series defective52. Remote access stops machines for five days2

Owner transfers millions after AI call

Large order from a sham company

ERP encrypted, production at a standstill for a month

Design data stolen

Machine parameters changed, series defective

Remote access stops machines for five days

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

6 scenarios, 6 receipts

  1. ERP encrypted, production at a standstill for a month
  2. Remote access stops machines for five days
  3. Design data stolen
  4. Owner transfers millions after AI call
  5. Machine parameters changed, series defective
  6. Large order from a sham company

1ERP encrypted, production at a standstill for a month

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 10'000–60'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 40–150 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 27'000–101'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 100–300 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Loss of revenue CHF 102'900–154'400 limited

    Indemnity period usually 12 months; sums insured in SME policies often CHF 50'000–500'000; a month’s standstill easily exceeds them. How we got there: 20–30 days × around CHF 7'350 revenue/day × 70% (assumption) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Contractual penalties no reliable figure not covered

    Third-party claims and defence against unfounded claims in the basic cover; Sunrise/AXA collective up to CHF 200'000. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 37'000–161'400
Open or only with an add-on
CHF 102'900–154'400
Usually stays with the business
1 item without an amount

Likelihood medium

Ransomware encrypts production software and data; the backups are also unusable. At three sites, production is at a standstill for over a month, and late deliveries trigger contractual penalties.

How it unfolds

The business does not survive the outage.

Entry point: Ransomware (Ryuk)

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real Swiss case Swisswindows (2019, bankruptcy); Fasana (DE 2025) around EUR 2 million loss of revenue in two weeks.

What prevents it

  • Backups immutable, offline, practise restoring.
  • Separate office and production networks.
  • Adjust the sum insured to a realistic outage.
Pitfalls in the terms

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Third-party claims after a data breach

2Remote access stops machines for five days

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • Local IT service provider CHF 4'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: Zurich sample case.

  • Machine manufacturer (maintenance after the attack) CHF 7'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: Zurich sample case.

  • Incident response team CHF 13'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: Zurich sample case.

  • Lost contribution margin from the cancelled order CHF 60'000 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: Zurich sample case: CHF 80'000 order minus CHF 20'000 saved costs.

  • Extra shifts CHF 5'000 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: Zurich sample case.

Usually paid by the cyber policy
CHF 24'000
Open or only with an add-on
CHF 65'000
Usually stays with the business
nothing

Likelihood medium

On a Sunday, a hacker uses a stolen password to gain access via the remote maintenance access and blocks the entire IT. For five days nothing is produced, an order worth CHF 80'000 has to be cancelled, and another is only completed with weekend shifts.

How it unfolds

Entry point: Stolen password for machine remote maintenance

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Zurich sample case with a full cost breakdown.

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • Remote maintenance only on request and with two-factor login.
  • Separate machine network.
  • Know the insurer’s 24/7 hotline.
Pitfalls in the terms

Modules: Restore data and systems, Immediate help in an emergency, Loss of income after an attack

3Design data stolen

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–14'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Ransom demand no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Bernina: demand around USD 1.3 million, only a test payment made.

  • Value of trade secrets no reliable figure not covered

    Helvetia excludes the market value of data and trade secrets (3.3.1.9 let. b). How we got there: Not insured.

Usually paid by the cyber policy
CHF 7'500–46'000
Open or only with an add-on
1 item without an amount
Usually stays with the business
1 item without an amount

Likelihood medium

A ransomware group copies design data and threatens to publish it; it demands more than a million dollars.

How it unfolds

Entry point: Ransomware with data theft

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real Swiss cases: Bernina 2023, Hoerbiger 2024, TRISA 2026.

What prevents it

  • Segment design data.
  • Monitor data outflow.
  • Crisis plan for extortion.
Pitfalls in the terms

Modules: Immediate help in an emergency, Cyber extortion, Restore data and systems

4Owner transfers millions after AI call

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • Amounts transferred CHF 100'000–3'000'000 not covered

    Telephone: Helvetia excluded, Zurich/Mobiliar only written online orders; AXA A6 with add-on, but the sub-limits are far lower. How we got there: Schwyz: «several million francs».

Usually stays with the businessCHF 100'000–3'000'000

Usually paid by the cyber policy
nothing
Open or only with an add-on
nothing

Likelihood medium

Over two weeks, a «business partner» calls with an AI-manipulated voice and convinces the owner of a confidential deal; he makes several transfers totalling several million.

How it unfolds

Entry point: Phone calls with an AI voice

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? Real case in the canton of Schwyz in 2026.

What prevents it

  • The owner also observes the four-eyes principle.
  • Call back on the known number.
  • Code word with business partners.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

5Machine parameters changed, series defective

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • Restore the parameter settings CHF 1'800–6'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 10–30 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Defective production series CHF 20'000–800'000 not covered

    In the sample case, Helvetia mentions financial losses from the defective series, but the «Mangelhafte Produktion» module is not part of KMU-Spezial. How we got there: Assumption; VZ scenario: recall of 340 components CHF 780'000.

  • Defective machine no reliable figure not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Cannot be quantified.

Usually stays with the businessCHF 20'000–800'000

Usually paid by the cyber policy
CHF 4'300–22'800
Open or only with an add-on
nothing
Usually stays with the business
plus 1 item without an amount

Likelihood low

After phishing, an attacker gets into the machine network and changes parameters; a defective series is produced unnoticed, and a machine fails.

How it unfolds

Entry point: Phishing, followed by access to the machine network

What AI changes: AI assistants with system access create new points of entry (prompt injection, VZ scenario).

Why low? Helvetia sample case and fictitious VZ scenario (CHF 3.28 million); real SME cases are not public.

Where does it say so?

Broschüre Cyber-Versicherung, 07.26 (Nr. 120015329)

Open document: Broschüre Cyber-Versicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • Log and approve parameter changes.
  • Quality control with random samples.
  • AI assistants without write access to production systems.
Pitfalls in the terms

Modules: Immediate help in an emergency, Restore data and systems, Property damage caused by an attack

6Large order from a sham company

Receipt

Production and industrial SMEs

Tap a line for the reasoning

  • Loss through advance payment or delivery no reliable figure unclear

    Helvetia covers fake identity fraud for orders of goods (let. c) with a sub-limit; not governed by others. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood low

A supposedly international company orders ten machines for CHF 2 million for a Swiss end customer; a confidentiality agreement prohibits direct contact. The perpetrators want an advance payment for «certificates» or delivery without payment.

How it unfolds

Entry point: Deception by email

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Described by the NCSC in 2024.

What prevents it

  • Check new major customers independently.
  • No advance payments to customers.
  • Commercial register and call-back.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 7'350 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 05.2019

    Swisswindows AG

    In May 2019, according to employees, the ransomware «Ryuk» encrypted production software and data, and the backups were also unusable.

  • Switzerland · 04.2023

    Bernina

    From 5 April 2023, the group ALPHV/BlackCat attacked the sewing machine manufacturer; sites in Thailand were also affected.

  • Switzerland · 07.2024

    Hoerbiger

    On 29 July 2024, the industrial group suffered a partial outage of its global IT; a third party had gained access and encrypted servers.

10 more cases and sample cases

  • Switzerland · 02.2026

    TRISA

    At the beginning of February 2026, a ransomware attacker briefly penetrated tightly limited areas of TRISA’s IT.

  • Switzerland · 01.2026

    Company (anonymous)

    Within two weeks, unknown perpetrators called the owner of a company in Schwyz and posed as a well-known business partner using an AI-manipulated voice.

  • Switzerland · 08.2024

    Swiss company A (anonymous)

    A supposedly international company asked Swiss company A for a quote for ten wood chippers worth 2 million francs; the buyer was to be another Swiss company, B. Company A had to sign a confidentiality agreement prohibiting direct contact with B and received back a signed offer with a stamp and a copy of an ID.

  • Germany · 05.2025Abroad: Germany

    Fasana GmbH

    On 19 May 2025, all printers in the plant suddenly printed ransom letters; the entire IT was paralysed and production came to a standstill.

  • Sample case from an insurer: Zurich

    Manufacturer of metal parts (CHF 3 million revenue, 15 employees): on a Sunday, a hacker uses a stolen password to get in through the remote maintenance access of the production machines and blocks the IT; 5 days without production, an urgent order worth CHF 80'000 has to be cancelled, and a second order can only be fulfilled with weekend shifts. Total according to the insurer: CHF 89'000.

    Sample case with a fictitious company («Metallteile-Muster AG»), not documented as a real loss. BI only in Optimum/Premium. At Zurich, control/production technology is part of the insured network.

    Where does it say so?

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, Schadenbeispiel Hersteller (1/2 und 2/2)

    «Übersicht der versicherten Kosten in diesem Beispiel: CHF 89’000 (Abzug von Selbstbehalt je nach Vereinbarung vorbehalten)»

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Helvetia

    Through phishing, a hacker obtains access data at a highly digitalised production business, gets into the machine network and changes parameters; a machine fails, and a defective production run results.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package». The benefit for the defective production series corresponds to the Helvetia module «Mangelhafte Produktion», which according to the GTC is not part of KMU-Spezial; the machine failure itself (property damage) is not mentioned as a benefit. According to the brochure, OT also includes refrigeration and heating technology.

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 6/9, «OT-Steuerungen gehackt»

    «Da die Manipulation nicht sofort bemerkt wird, fällt eine Maschine aus, und es entsteht eine fehlerhafte Produktionsreihe.»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: broker:vz

    Fictitious case study AlpPrecision AG (aviation supplier): leaked password and «prompt injection» in the internal AI assistant; attackers shift CNC tolerances by micrometres, the AI quality control reports «passed»; followed by extortion with the threat of informing the most important customer. Total according to the insurer: CHF 3'280'000.

    Fictitious scenario by a broker, not an insurance benefit. Modules assigned by us: recall (property damage/defective production), contractual penalties and loss of customers are usually excluded or not insured in the cyber GTC reviewed; insurable would mainly be forensics, restoration, BI and legal advice (around 1.4 million of 3.28 million).

    Where does it say so?

    VZ-Studie Cyberrisiken für KMU – Marktanalyse der Cyberversicherungen (mit HSLU), Oktober 2026, Kap. 2.2, Abbildung 6, S. 9

    «Für ein KMU wie die AlpPrecision AG ist der Gesamtschaden von 3,28 Millionen Franken potenziell existenzbedrohend.»

    Open document: VZ-Studie Cyberrisiken für KMU – Marktanalyse der Cyberversicherungen (mit HSLU) (opens in a new window), retrieved 06.11.2026

  • Sample case from a property insurer, for comparison: Zurich

    New CNC milling machine with internal operational damage, motor defective and replaced. Not a cyber case. Total according to the insurer: CHF 8'000.

    Distinction: machinery insurance pays for the technical defect. If the machine is damaged by manipulated controls, the cyber insurance pays only for the controls (data/software), not for the machine.

    Where does it say so?

    Factsheet Zurich Sachversicherung, ZH21646d-2301, Schadenbeispiele, Technische Anlagen/Maschinenversicherung

    «Die neue CNC-Fräse hat einen inneren Betriebsschaden.»

    Open document: Factsheet Zurich Sachversicherung (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Helvetia

    A company stores all its data in an external cloud; a hacker encrypts it there with ransomware, followed by a production interruption.

    Insurer’s sample case without amounts; Helvetia: benefits «depending on the selected benefit package». Relevant for g.bu_dienstleister: the attacked cloud counts as the business’s own IT system.

    Where does it say so?

    Cyber-Versicherung (Broschüre), 07.26 (Nr. 120015329), S. 6/9, «Verschlüsselung von Daten in einer Cloud»

    «Weil auch eine externe Cloud zum IT-System eines Unternehmens gehört, übernimmt Helvetia die daraus entstehenden Kosten»

    Open document: Cyber-Versicherung (Broschüre) (opens in a new window), retrieved 06.11.2026

  • Sample case from an insurer: Mobiliar

    After a cyber attack, a production business cannot process orders or control machines; interruption of several days, delivery delays, loss of customers.

    Sample case without an amount. According to the Mobiliar GTC, loss of customers (reputation) as lost profit is in principle not insured.

    Where does it say so?

    Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele), abgerufen 06.11.2026, Schadenbeispiele, Ertragsausfall «Betriebsstopp durch Cyberangriff»

    Open document: Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele) (opens in a new window), retrieved 06.11.2026

Three ways forward