Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Restaurant and catering: what can happen, and who pays?

limited 10 of 17 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. Since October 2026, attackers in several European countries have been manipulating refrigeration systems via the internet.

Who pays for spoiled goods after an attack

As of

Restaurant and catering2. Fake card payment in the takeaway shop23. Beverage supplier with «new bank details»31. Till and reservations gone on Saturday evening due to ransomware14. Guest data leaked at the reservation provider3045. Cold room heated up via remote maintenance5

Fake card payment in the takeaway shop

Beverage supplier with «new bank details»

Till and reservations gone on Saturday evening due to ransomware

Guest data leaked at the reservation provider

Cold room heated up via remote maintenance

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Till and reservations gone on Saturday evening due to ransomware
  2. Fake card payment in the takeaway shop
  3. Beverage supplier with «new bank details»
  4. Guest data leaked at the reservation provider
  5. Cold room heated up via remote maintenance

1Till and reservations gone on Saturday evening due to ransomware

Receipt

Restaurant and catering

Tap a line for the reasoning

  • IT emergency at the weekend: restore the till, reservations and office PC CHF 2'200–8'100 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 8–24 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'500–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 6–20 h × CHF 250–400/h (market range for incident response)

  • Resetting till tablets and office PC CHF 540–6'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 3–8 devices × CHF 180–800 per device

  • Loss of revenue on Saturday evening (partial outage) and closed on Sunday CHF 2'900–5'800 limited

    Only after the waiting period: with a 24 h waiting period (Helvetia), Saturday evening is borne by the business; Mobiliar pays only with the add-on, Zurich only Optimum/Premium. How we got there: 1–2 days × around CHF 2'880 revenue/day (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Ransom (not recommended) no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: No Swiss average found.

Usually paid by the cyber policy
CHF 4'240–22'500
Open or only with an add-on
CHF 2'900–5'800, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

At 18:00 on Saturday, the till tablets and the reservation system no longer start; there is a ransom demand on the office PC. The service staff write orders by hand and only take cash or Twint to a private mobile phone, reservations are unknown, and some guests find all the tables full.

How it unfolds

Only on Monday does the IT partner restore the till and data from the backup; the restaurant stays closed on Sunday.

Entry point: Stolen remote maintenance password or phishing email to the office

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Till and reservation systems are central single systems; ransomware incidents involving tills are documented in retail and at till providers (NCR Aloha). No public case is known for a Swiss restaurant.

Where does it say so?

Halbjahresbericht 2026/I (Januar–Juni), 24.08.2026

Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

What prevents it

  • Till with offline mode and a paper emergency kit (receipt pad, price list, cash box).
  • Back up reservations daily as a PDF/printout; cloud tool with its own password and two-factor login.
  • Open remote maintenance only on request; backup offline and tested.
Pitfalls in the terms

Modules: Restore data and systems, Immediate help in an emergency, Loss of income after an attack, Cyber extortion

2Fake card payment in the takeaway shop

Receipt

Restaurant and catering

Tap a line for the reasoning

  • Forensics including investigation according to card industry requirements CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 1'200–7'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of guests by letter (postage only) CHF 300–3'600 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 300–3'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Claims by the card industry (penalties, card replacement) no reliable figure limited

    Zurich and Helvetia pay PCI penalties, where insurable; Mobiliar only as an add-on with valid PCI certification; AXA excludes them (B4, B11). How we got there: No Swiss amounts found.

  • Loss of takeaway revenue while the shop is offline CHF 1'200–4'000 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 2–7 days × around CHF 2'880 revenue/day × 20% (assumption: share of online orders) (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 4'000–26'600
Open or only with an add-on
CHF 1'200–4'000, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

Malicious code is injected into the payment page of the ordering shop: next to Twint, a fake «credit card» option appears that sends card data to the perpetrators. Only weeks later do guests report misuse; the card companies demand an investigation.

How it unfolds

Entry point: Vulnerability in the shop system or in an embedded third-party script

What AI changes: AI makes fake payment forms visually flawless and available in several languages.

Why medium? Documented at a Swiss food delivery webshop in 2026 and at the ESA shop in 2024.

What prevents it

  • Run the shop with a hosted payment page from the payment provider (card data never on your own server).
  • Have changes to the payment page monitored.
  • Updates and two-factor login for the shop back end.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Card industry penalties, Loss of income after an attack

3Beverage supplier with «new bank details»

Receipt

Restaurant and catering

Tap a line for the reasoning

  • Invoice amount transferred CHF 3'000–20'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Assumption: monthly beverage invoice; no sector source.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 3'000–20'000
Usually stays with the business
nothing

Likelihood medium

A genuine-looking invoice with a new IBAN and QR code comes from the beverage dealer’s hacked mailbox. The landlady pays CHF 8'000; the real dealer sends a reminder a month later.

How it unfolds

Entry point: Hacked email account of the supplier

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? The NCSC describes manipulated QR-bills with Swiss accounts that are hardly recognisable.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Accept a new IBAN only after a call-back on the known number.
  • Have QR-bills with a changed IBAN flagged in accounting.
  • Use the supplier master data in e-banking as a template; do not enter new details from the email.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Mobiliar does not pay if a payment request was evidently forged or not personalised, or concerns goods that were never ordered (B8.2 let. c).
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.2 lit. c

    «weil Sie frei erfundene oder erkennbar gefälschte Zahlungsaufforderungen bezahlt haben»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Guest data leaked at the reservation provider

Receipt

Restaurant and catering

Tap a line for the reasoning

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 750–4'200 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–12 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of guests by letter (postage only) CHF 500–6'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 500–5'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Claims by affected guests no reliable figure covered

    Covered in the event of a data protection breach; at AXA, data entrusted to a third party also counts (E7). Whether a leak at the provider is sufficient must be checked in each individual case. How we got there: No amounts found.

Usually paid by the cyber policy
CHF 1'250–10'200, plus 1 item without an amount
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood medium

Names, telephone numbers and reservations leak at the provider of the reservation tool. Shortly afterwards, guests receive WhatsApp messages in the name of the restaurant with a link to «confirm the credit card».

How it unfolds

Guests complain to the restaurant.

Entry point: Data leak at the service provider; phishing aimed at guests

What AI changes: AI writes credible messages with real reservation data in several languages.

Why medium? Same pattern documented at Swiss hotels in 2024 and 2026 (Waldstätterhof, Lenzerheide).

What prevents it

  • Choose a provider with a data processing agreement and a reporting obligation.
  • Inform guests on the website that the restaurant never asks for card details via WhatsApp.
  • Record only the guest data that is necessary.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people, Third-party claims after a data breach

5Cold room heated up via remote maintenance

Receipt

Restaurant and catering

Tap a line for the reasoning

  • Spoiled goods CHF 3'000–15'000 not covered

    Excluded in all cyber GTC reviewed (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b, Chubb 4.8); at AXA also the resulting loss of income. How we got there: Assumption: a restaurant’s weekly stock; revenue around CHF 2'880/day (SFTA 2024), cost of goods not documented.

  • Refrigeration technician: reset the control system CHF 810–2'700 covered

    Control system = IT system; hourly rate as an assumption. How we got there: 3–8 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Loss of lunchtime revenue CHF 1'400–2'900 not covered

    Consequence of the property damage: AXA B6, Helvetia 3.2.3 b. How we got there: ½–1 days × around CHF 2'880 revenue/day (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually stays with the businessCHF 4'400–17'900

Usually paid by the cyber policy
CHF 810–2'700
Open or only with an add-on
nothing

Likelihood low

The cold room with meat, fish and dairy products is switched to defrost via the refrigeration technician’s open remote maintenance. In the morning the goods are warm and have to be thrown away; the lunch menu is cancelled.

How it unfolds

Entry point: Remote maintenance of the refrigeration system on the internet

What AI changes: As with the butcher’s shop.

Why low? Wave of attacks on refrigeration control systems in retail documented from October 2026; catering businesses less often have central remote maintenance (assumption).

Where does it say so?

CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

«Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

What prevents it

  • Ask the refrigeration technician whether the system can be reached from the internet.
  • Your own temperature alarm to your mobile phone.
  • Have the property and cyber policies checked for refrigerated goods after a hacker attack.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Property insurance usually does not help: refrigerated goods are insured there only as an add-on and only in the event of a technical defect or power interruption (AXA property B8, Allianz C6.3.3); AXA excludes operating errors (B8.5) and, in the catch-all provision, hacker attacks (let. s), Mobiliar All Risks excludes cyber risks (section 3).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung, Ausgabe 06.2024 (16373DE – 2024-06), Nicht genannte Gefahren, lit. s

    «Schäden verursacht durch Schadprogramme, Hacker- und Denial-of-Service-Angriffe sowie andere Cyber-Ereignisse.»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung (opens in a new window), retrieved 06.11.2026

Modules: Property damage caused by an attack, Restore data and systems, Loss of income after an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 2'880 Average revenue per day; your business may be smaller.

CHF 300–750 Annual premium for a micro business, indicative value based on the Helvetia rate, group A, not a quote.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: good.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

Only a few insurers publish rates. We assign your industry to the Helvetia rate Group A (among others, main and ancillary construction trades, café/restaurant); this assignment is ours, not the insurer’s.

Indicative premiums for Restaurant and catering per year (indicative value, not a quote)
Business Sum insured Annual premium How we got there
Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A) First-party loss 50'000–200'000, liability 500'000–1 million around CHF 300–750Indicative value, not a quote
How we got there for Micro business < CHF 1 million revenue, restaurant or trade (Helvetia Group A)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.1

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, S. 15

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026
SME CHF 1–5 million revenue, Group A (trades, restaurant) First-party loss 100'000–500'000, liability 500'000–1 million around CHF 550–1'200Indicative value, not a quote
How we got there for SME CHF 1–5 million revenue, Group A (trades, restaurant)

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.2

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026
SME CHF 5–10 million revenue, Groups A to C First-party loss 200'000–500'000, liability 500'000–1 million around CHF 800–3'100Indicative value, not a quote
How we got there for SME CHF 5–10 million revenue, Groups A to C

Derivation: lower bound = lowest public annual premium (Helvetia KMU-Spezial ECO, tariff 01.07.2026), upper bound = TOP variant of the same group. Cross-check: Zurich Basic from 410 / Optimum from 690 (brochure 2023, parameters unknown), Sunrise/AXA 479 at 20k/200k. Only two insurers with public prices; tariff price before risk assessment and without discounts. Guide value, derived; not a quote.

Where does it say so?

Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), Ausgabe 01.07.2026, Ziff. 1.3

Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

What is connected in the business

Real cases

  • Switzerland · 08.2026

    Food delivery webshop (anonymous)

    Attackers injected malicious code into the genuine payment page of a webshop for food orders.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 07.2024

    Hotel Waldstätterhof

    Via an old program, criminals hacked an external software provider of the hotel and captured guests’ email addresses and future stays.

5 more cases and sample cases

  • Switzerland · 09.2026

    Hotel Schweizerhof Lenzerheide

    Criminals stole booking data from a component of the hotel’s booking system and wrote to guests via WhatsApp.

  • USA · 04.2023Abroad: USA

    Restaurants with the NCR Aloha till system (provider NCR)

    Ransomware at the till provider NCR paralysed additional functions of restaurant tills.

  • international · 12.2024Abroad: international

    Official online shop of the European Space Agency ESA

    Shortly before Christmas 2024, the company Sansec discovered a script in the ESA shop that showed a fake payment page at checkout and captured card data.

  • France · 10.2026Abroad: France

    Intermarché, Coopérative U, Carrefour (more than 230 branches)

    During the night before 12 October 2026, attackers switched the refrigeration and freezer systems of around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops to defrost mode; for around six hours the temperature rose to as much as 50 degrees.

  • Sample case from an insurer: Mobiliar

    Mobiliar comparison: two days without appointment management and payments, pro rata loss of income.

    Sample case without an amount. Mobiliar: loss of income from 12 hours of standstill, full daily compensation for a complete outage, pro rata for a partial outage; BI only as an add-on.

    Where does it say so?

    Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele), abgerufen 06.11.2026, Schadenbeispiele, Ertragsausfall «Ertragsverlust durch Cyberangriff»

    Open document: Cyberversicherung für Unternehmen (Produktseite, Schadenbeispiele) (opens in a new window), retrieved 06.11.2026

Three ways forward