Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Transport and logistics: what can happen, and who pays?

limited 5 of 12 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Dispatching encrypted, lorries at a standstill” (likelihood medium).

As of

Transport and logistics1. Dispatching encrypted, lorries at a standstill13. Fake boss demands payment32. Freight payment to fraudsters25. Fleet portal hacked54. Cold chain logistics without IT4

Dispatching encrypted, lorries at a standstill

Fake boss demands payment

Freight payment to fraudsters

Fleet portal hacked

Cold chain logistics without IT

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Dispatching encrypted, lorries at a standstill
  2. Freight payment to fraudsters
  3. Fake boss demands payment
  4. Cold chain logistics without IT
  5. Fleet portal hacked

1Dispatching encrypted, lorries at a standstill

Receipt

Transport and logistics

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 8'100–33'800 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 30–100 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Loss of revenue CHF 15'500–51'600 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 3–10 days × around CHF 10'310 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Contractual penalties from clients no reliable figure not covered

    Contractual penalties are excluded. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 13'100–65'800
Open or only with an add-on
CHF 15'500–51'600
Usually stays with the business
1 item without an amount

Likelihood medium

Using a guessed password, a ransomware group encrypts all systems; without dispatching and delivery notes, the lorries do not run. The demand is unaffordable for the business.

How it unfolds

Entry point: Guessed password of an employee

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? KNP Logistics (UK, 2023) went into insolvency after an Akira attack; Swissport 2022 with delays.

What prevents it

  • Two-factor login for all accounts.
  • Emergency operation with paper delivery notes.
  • Offline backup.
Pitfalls in the terms

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Third-party claims after a data breach

2Freight payment to fraudsters

Receipt

Transport and logistics

Tap a line for the reasoning

  • Outstanding freight invoice CHF 2'000–30'000 not covered

    Only Helvetia 3.3.1.8 let. b. How we got there: Assumption.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually stays with the businessCHF 2'000–30'000

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
nothing

Likelihood medium

A client pays the freight invoice into a fake account after the haulier’s email account was hacked.

How it unfolds

Entry point: Hacked email account

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Invoice manipulation is widespread.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Two-factor login.
  • IBAN notice.
  • Check incoming payments.
Pitfalls in the terms
  • Own money only: Mobiliar (B8) and Zurich (Art. 702) reimburse only the insured’s own means of payment. If a customer pays into a wrong account because of the hacked email account, among the GTC reviewed only Helvetia expressly covers this (3.3.1.8 let. b, sub-limit).
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8 lit. b, S. 12

    «wenn diese finanzielle Transaktion aufgrund einer auf dem IT-System des Versicherungsnehmers vorgenommene Manipulation»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions, Immediate help in an emergency

3Fake boss demands payment

Receipt

Transport and logistics

Tap a line for the reasoning

  • Amount transferred CHF 20'000–300'000 limited

    With an email, the add-on may apply; call only: Helvetia excluded. How we got there: Documented comparable cases up to CHF 300'000 (Valais).

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 20'000–300'000
Usually stays with the business
nothing

Likelihood medium

The accounts department receives an email and a call from the supposed owner about an urgent payment abroad.

How it unfolds

Entry point: Email plus call

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why medium? NCSC: 970 reports of CEO fraud in 2025.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Code word.
  • Call back.
  • Four-eyes principle.
Pitfalls in the terms
  • Call with a cloned voice: under the GTC, Helvetia does not reimburse payments triggered by phone calls, voice messages or videos (3.3.1.8, p. 12), unless the policy contains special condition 3.7.6 (included in the KMU-Spezial sample policy, with proof of basic security measures). Zurich (Art. 702.2) and Mobiliar (B8.1) require an order transmitted online in writing. Only AXA A6 expressly mentions contact by telephone.
    Where does it say so?

    Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial), Ausgabe Juni 2026, Ziff. 3.3.1.8, S. 12

    «die durch Telefonanrufe (inkl. IP-Telefonie), Sprachnachrichten oder Videos initiiert werden (z.B. durch Deepfake)»

    Open document: Allgemeine Versicherungsbedingungen Helvetia Cyber-Versicherung (Musterwording KMU-Spezial) (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Cold chain logistics without IT

Receipt

Transport and logistics

Tap a line for the reasoning

  • Loss of revenue CHF 25'800–36'100 limited

    Only after the waiting period (AXA 12 h, Mobiliar 12 h only with add-on, Helvetia 24 h, Zurich only Optimum/Premium). What is reimbursed is revenue minus saved costs (AXA) or EBITDA (Helvetia), not revenue. How we got there: 5–7 days × around CHF 10'310 revenue/day × 50% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 5'400–18'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 30–80 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Spoiled customer goods no reliable figure not covered

    Property damage; liability towards customers is more a matter of carrier’s liability. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 5'400–18'000
Open or only with an add-on
CHF 25'800–36'100
Usually stays with the business
1 item without an amount

Likelihood low

Ransomware paralyses the IT of a cold chain logistics company; deliveries to supermarkets are held up for a week, and goods in the warehouse run short.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why low? Bakker Logistiek (NL, 2021), around six days of restoration.

What prevents it

  • Emergency process for cold chains.
  • Independent temperature loggers.
  • Backups.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Loss of income after an attack, Restore data and systems, Property damage caused by an attack

5Fleet portal hacked

Receipt

Transport and logistics

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'000–4'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 4–12 h × CHF 250–400/h (market range for incident response)

  • Stolen load no reliable figure not covered

    Theft is a matter for property or transport insurance. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 1'000–4'800
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood low

Using a stolen password, perpetrators log in to the telematics portal, see locations and loads and sell the information to thieves.

How it unfolds

Entry point: Stolen password

What AI changes: AI phishing for portal logins.

Why low? No Swiss case known.

What prevents it

  • Two-factor login in the portal.
  • Location data only for authorised persons.
  • Have unusual logins reported.
Pitfalls in the terms
  • Property damage excluded: no cyber GTC reviewed pays for spoiled goods, dead animals or damaged machines (AXA B6, Mobiliar E let. e, Zurich Art. 5, Helvetia 3.2.3 b); AXA also excludes the loss of income resulting from the property damage. The control system itself counts as an IT system (AXA E11, Zurich Art. 102.1).
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6 und E11

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Property damage caused by an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 10'310 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 02.2022

    Swissport International

    At the beginning of February 2022, a ransomware attack paralysed parts of the IT of the ground handling company Swissport.

  • Switzerland · 06.2022

    Garage (anonymous) and its customer

    A customer bought a used car from a garage and received the invoice for more than 18'000 francs by email.

  • Switzerland · 01.2024

    Company (anonymous)

    Fraudsters posed as the boss to a company in Central Valais and demanded a large payment.

2 more cases and sample cases

  • United Kingdom · 06.2023Abroad: United Kingdom

    KNP Logistics Group (including Knights of Old)

    In June 2023, the Akira group encrypted the transport company’s systems; without access to data, the business could no longer be run.

  • Netherlands · 04.2021Abroad: Netherlands

    Bakker Logistiek

    Over Easter 2021, ransomware paralysed the IT of the cold chain logistics company; deliveries from three warehouses were held up, and packaged cheese ran short in Albert Heijn branches.

Three ways forward