Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Association and foundation: what can happen, and who pays?

limited 7 of 11 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Treasurer pays on the «president’s» email” (likelihood high).

As of

Association1. Treasurer pays on the «president’s» email13. Intercepted invoice for jerseys34. Membership list with dates of birth published42. Association’s Instagram account taken over25. Foundation encrypted, data on the darknet5

Treasurer pays on the «president’s» email

Intercepted invoice for jerseys

Membership list with dates of birth published

Association’s Instagram account taken over

Foundation encrypted, data on the darknet

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Treasurer pays on the «president’s» email
  2. Association’s Instagram account taken over
  3. Intercepted invoice for jerseys
  4. Membership list with dates of birth published
  5. Foundation encrypted, data on the darknet

1Treasurer pays on the «president’s» email

Receipt

Association and foundation

Tap a line for the reasoning

  • Amount transferred CHF 500–5'000 add-on

    Many associations have no cyber policy; SME products are geared towards companies. In Germany, the association’s financial loss liability insurance paid. How we got there: Comparable cases in Germany: EUR 1'900–3'850.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 500–5'000
Usually stays with the business
nothing

Likelihood high

The treasurer receives a request from the supposed president to pay an invoice for sports shoes. He transfers CHF 2'800.

How it unfolds

Entry point: Fake email using names from the association’s website

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why high? NCSC: numerous reports against churches, schools, associations and political parties (December 2024); sports club case 2022.

What prevents it

  • Payments only with a receipt and approval by two board members.
  • On the website, only role-based addresses instead of personal names.
  • Call the president back.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

2Association’s Instagram account taken over

Receipt

Association and foundation

Tap a line for the reasoning

  • Recover the account CHF 360–1'400 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 2–6 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Reputational damage no reliable figure not covered

    Loss of income due to loss of reputation: expressly excluded by Helvetia, not provided for by AXA, Mobiliar and Zurich; only Chubb as an add-on. PR costs are paid by g.soforthilfe. How we got there: Cannot be quantified.

Usually paid by the cyber policy
CHF 360–1'400
Open or only with an add-on
nothing
Usually stays with the business
1 item without an amount

Likelihood high

After phishing, perpetrators take over the Instagram account and post crypto adverts.

How it unfolds

Entry point: Phishing

What AI changes: AI generates advertising texts and images.

Why high? NCSC cases of accounts taken over.

What prevents it

  • Two-factor login.
  • At least two admins.
  • Recovery data up to date.
Pitfalls in the terms

Modules: Restore data and systems, Reputational damage

3Intercepted invoice for jerseys

Receipt

Association and foundation

Tap a line for the reasoning

  • Advance payment CHF 1'000–5'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Comparable case: EUR 2'848.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 1'000–5'000
Usually stays with the business
nothing

Likelihood medium

The supplier’s invoice is intercepted in transit and the bank details changed; the association pays in advance, and the jerseys never arrive.

How it unfolds

Entry point: Manipulated invoice

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Documented in Germany (2024), the insurance paid.

What prevents it

  • Confirm the IBAN by telephone.
  • No advance payment to new suppliers.
  • Two signatures.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Membership list with dates of birth published

Receipt

Association and foundation

Tap a line for the reasoning

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 500–2'800 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 2–8 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of members by letter (postage only) CHF 100–2'400 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 100–2'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

Usually paid by the cyber policy
CHF 600–5'200
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood medium

A membership list with addresses and dates of birth is in an open cloud folder and is found.

How it unfolds

Entry point: Folder shared incorrectly

What AI changes: AI search finds open documents more quickly.

Why medium? Common operating error (assumption).

What prevents it

  • Check shares annually.
  • Only necessary data.
  • Designate a person responsible for data.
Pitfalls in the terms
  • Operating errors without an attack: AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover negligent errors by staff.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. E2, S. 16

    «Ein Cyber-Eigenschaden-Ereignis ist ein vorsätzlicher, schädigender Angriff durch Dritte oder durch versicherte Personen»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Inform affected people

5Foundation encrypted, data on the darknet

Receipt

Association and foundation

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–24'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–60 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of affected persons by letter (postage only) CHF 500–6'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 500–5'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Outage CHF 7'100–23'800 limited

    SFTA value for associations with little informative value. How we got there: 3–10 days × around CHF 11'900 revenue/day × 20% (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

Usually paid by the cyber policy
CHF 11'600–54'000
Open or only with an add-on
CHF 7'100–23'800
Usually stays with the business
nothing

Likelihood medium

A non-profit foundation falls victim to ransomware; data of partners, including federal agencies, ends up on the darknet.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Real case Stiftung Radix (2025).

What prevents it

  • Offline backup.
  • Two-factor login.
  • Keep partners’ data separate.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Inform affected people, Loss of income after an attack

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 11'900 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: weak.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 01.2022

    Sports club (anonymous)

    Fraudsters found out about a sports club in advance and wrote to the treasurer in the name of the president.

  • Switzerland · 12.2024

    Churches, schools, associations and political parties (anonymous)

    In December 2024, the NCSC received numerous reports of CEO fraud against churches, schools, associations and political parties whose websites show many names and roles.

  • Switzerland · 04.2022

    Museum (anonymous)

    Via the Facebook Business Manager, a museum received a supposed message from the «Instagram Copyright Help Center» about a copyright infringement.

4 more cases and sample cases

  • Switzerland · 06.2025

    Stiftung Radix

    In June 2025, the non-profit foundation for health promotion fell victim to a ransomware attack: data was stolen, encrypted and then published on the darknet.

  • GermanyAbroad: Germany

    Sports club with a running group (anonymous)

    The club ordered jerseys and paid the invoice in advance.

  • GermanyAbroad: Germany

    Sports club (anonymous)

    Via the chairman’s hacked email account, the treasurer received a fake invoice for fitness equipment.

  • GermanyAbroad: Germany

    Association (anonymous)

    A supposed employee of the Sparkasse called the treasurer and got him to disclose TAN numbers.

Three ways forward