Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Dental practice: what can happen, and who pays?

limited 10 of 14 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Ransomware closes the practice for two weeks” (likelihood medium).

As of

Dental practice4. Data leaked from online appointment booking3043. Fake invoice from the dental laboratory35. Trojan in the practice’s e-banking52. X-ray PC without updates becomes the point of entry21. Ransomware closes the practice for two weeks1

Data leaked from online appointment booking

Fake invoice from the dental laboratory

Trojan in the practice’s e-banking

X-ray PC without updates becomes the point of entry

Ransomware closes the practice for two weeks

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Ransomware closes the practice for two weeks
  2. X-ray PC without updates becomes the point of entry
  3. Fake invoice from the dental laboratory
  4. Data leaked from online appointment booking
  5. Trojan in the practice’s e-banking

1Ransomware closes the practice for two weeks

Receipt

Dental practice

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 5'000–32'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 8'100–27'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 30–80 h × CHF 270–338/h (IT support with 50% surcharge outside office hours)

  • Resetting practice and X-ray PCs CHF 1'400–16'000 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 8–20 devices × CHF 180–800 per device

  • Loss of revenue during the closure CHF 47'000–94'100 limited

    SFTA value for dentists with little informative value (medical treatment exempt from VAT, only 323 VAT-registered businesses). How we got there: 5–10 days × around CHF 9'410 revenue/day (SFTA VAT statistics 2024, average of businesses liable for VAT; small businesses are lower)

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 2'500–10'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–30 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of patients by letter (postage only) CHF 2'000–12'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 2'000–10'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

  • Ransom (not recommended) no reliable figure limited

    Ransom: Mobiliar and Sunrise never, AXA only with extension, Zurich within sub-limit 25%, Helvetia CHF 30'000–100'000, Chubb in principle yes; reporting to the police is mandatory. How we got there: Comparison with Germany: 10 Bitcoin, around EUR 220'000; data published nevertheless.

Usually paid by the cyber policy
CHF 19'000–97'500
Open or only with an add-on
CHF 47'000–94'100, plus 1 item without an amount
Usually stays with the business
nothing

Likelihood medium

An employee opens an email with supposed appointment proposals; a Trojan encrypts the practice software and the X-ray archive. The perpetrators demand ten Bitcoin and publish patient data despite payment.

How it unfolds

The practice stays completely closed for two weeks and loses patients.

Entry point: Email attachment

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? Real German case (group practice, 18 employees): total loss of around EUR 500'000, most of which was paid by the cyber insurance. No public dental practice case in Switzerland.

What prevents it

  • Open emails with attachments from unknown senders only in a protected environment.
  • X-ray and practice PCs in separate networks.
  • Daily backup, offline, tested.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.
    Where does it say so?

    Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle), 01.07.2026, Ziff. 1.1, Karenzfrist 24 Std.

    Open document: Antrag Cyber-Versicherung – KMU-Spezial (mit Prämientabelle) (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems, Loss of income after an attack, Inform affected people, Cyber extortion

2X-ray PC without updates becomes the point of entry

Receipt

Dental practice

Tap a line for the reasoning

  • Manufacturer and IT: isolate the device, reset it CHF 1'400–4'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 8–20 h × CHF 180–225/h (IT support for SMEs, office hours)

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 1'200–8'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 5–20 h × CHF 250–400/h (market range for incident response)

Usually paid by the cyber policy
CHF 2'600–12'500
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood medium

The PC on the X-ray device runs an old operating system because the manufacturer does not release an update. An attacker exploits a known vulnerability and spreads through the practice network.

How it unfolds

Entry point: Old operating system on a medical device

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Old systems on devices are widespread (assumption); this is exactly where the insurers’ patch obligations apply.

What prevents it

  • Device PCs without internet and in their own network.
  • Agree an update or replacement plan with the manufacturer.
  • Disclose old devices to the insurer in the application.
Pitfalls in the terms

Modules: Restore data and systems, Immediate help in an emergency

3Fake invoice from the dental laboratory

Receipt

Dental practice

Tap a line for the reasoning

  • Laboratory invoice transferred CHF 3'000–20'000 add-on

    Only as an add-on (AXA A6, Mobiliar B8, Zurich Premium) or with a sub-limit (Helvetia CHF 30'000–100'000); almost always a call-back obligation for new bank details. How we got there: Assumption: a laboratory’s monthly invoice.

Usually paid by the cyber policy
nothing
Open or only with an add-on
CHF 3'000–20'000
Usually stays with the business
nothing

Likelihood medium

The dental laboratory apparently sends the monthly invoice with new bank details; the laboratory’s mailbox had been hacked. The practice pays CHF 12'000 to fraudsters.

How it unfolds

Entry point: Hacked email account of the laboratory

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why medium? According to the NCSC, invoice manipulation is widespread.

Where does it say so?

Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025, 30.12.2025

Open document: Woche 52: Gezielter, komplexer, raffinierter – Knapp 65'000 Meldungen ans BACS im 2025 (opens in a new window), retrieved 06.11.2026

What prevents it

  • Call back when the IBAN changes.
  • Four-eyes principle.
  • Supplier IBAN as a template.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

  • Call-back obligation: verify new or changed bank details by call-back (or digital signature) and document this in writing, otherwise cover lapses (AXA A6, Zurich Art. 704); Helvetia requires secure verification from CHF 30'000.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 704, S. 15

    «Als sicheres Verfahren gelten ein telefonischer Rückruf zur Identitätsprüfung und jede Form von digital signierter Kommunikation.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Fraud with fake instructions

4Data leaked from online appointment booking

Receipt

Dental practice

Tap a line for the reasoning

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 750–3'500 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–350/h (lawyer’s rate in Switzerland)

  • Notification of patients by letter (postage only) CHF 1'000–6'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–5'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

Usually paid by the cyber policy
CHF 1'750–9'500
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood low

At the provider of online appointment booking, names, dates of birth and reasons for treatment of many practices are copied. The practice has to inform its patients even though it was not attacked itself.

How it unfolds

Entry point: Data leak at the service provider

What AI changes: AI makes follow-up phishing with real data easier.

Why low? No Swiss case known at appointment booking providers; pattern documented in the hotel sector.

What prevents it

  • Provider with registered office and data storage in Switzerland and a data processing agreement.
  • Do not record reasons for treatment in the booking tool.
  • Agree a reporting channel with the provider.
Pitfalls in the terms

Modules: Immediate help in an emergency, Inform affected people

5Trojan in the practice’s e-banking

Receipt

Dental practice

Tap a line for the reasoning

  • Amount lost CHF 5'000–50'000 add-on

    Add-on at AXA (with 2FA), Mobiliar, Zurich (Cyber-Crime); Helvetia in the basic cover with sub-limit; Sunrise excluded. How we got there: Assumption.

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 750–4'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 3–10 h × CHF 250–400/h (market range for incident response)

Usually paid by the cyber policy
CHF 750–4'000
Open or only with an add-on
CHF 5'000–50'000
Usually stays with the business
nothing

Likelihood low

A banking Trojan on the reception PC intercepts the login and triggers a payment of CHF 30'000.

How it unfolds

Entry point: Malware on the PC used for e-banking

What AI changes: AI writes flawless, personally tailored phishing emails in German close to Swiss dialect; the old warning sign of «bad German» disappears. According to IBM, attackers used AI in 16% of data breaches in 2025, mostly for phishing.

Why low? Today banks protect with two-factor approval; sample cases at Zurich.

Where does it say so?

Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023

Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

What prevents it

  • E-banking on a separate device.
  • Set low payment limits.
  • Check the amount when approving payments via the app.
Pitfalls in the terms
  • Social engineering is usually only an add-on module (AXA A6, Mobiliar B8, Zurich module G Premium) or has a low sub-limit (Helvetia ECO CHF 30'000). Without the add-on, the cyber policy does not pay the amount transferred.
    Where does it say so?

    Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen, Ausgabe 01.2024, Ziff. B8.1

    «Der Versicherungsschutz gilt, sofern diese Deckung ausdrücklich in der Police erwähnt ist.»

    Open document: Cyberversicherung, Kundeninformationen und Allgemeine Bedingungen (opens in a new window), retrieved 06.11.2026

Modules: Hacked e-banking, Immediate help in an emergency

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 9'410 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: weak.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 10.2019

    GZO Spital Wetzikon

    In mid-October 2019, the Emotet Trojan infected the hospital’s network, very probably via an email with a Word attachment.

  • Switzerland · 01.2023

    Company (anonymous)

    Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.

  • Switzerland · 09.2026

    Hotel Schweizerhof Lenzerheide

    Comparison with the hotel sector: leak in a booking component.

3 more cases and sample cases

  • GermanyAbroad: Germany

    Dental group practice (anonymous)

    In a group practice with four dentists and 18 employees, someone opened an email attachment, whereupon a Trojan encrypted the IT and 10 Bitcoin (around 220'000 euros) were demanded.

  • Germany · 10.2016Abroad: Germany

    Dental practice (anonymous)

    Criminals introduced ransomware into the practice network, encrypted the patient data and threatened to delete everything unless they were paid.

  • Sample case from an insurer: Zurich

    Fiduciary firm (CHF 6.5 million revenue, 22 employees) executes payments for clients. An employee opens a supposed unsolicited job application containing malware; the hacker takes over the e-banking session at login and diverts money from client accounts. Total according to the insurer: CHF 142'000.

    Sample case («Treuhand-Muster AG»). Cyber-Crime (e-banking hacking) only in the Premium package; forensics found no data outflow.

    Where does it say so?

    Broschüre Zurich Cyberversicherung, PDF vom 21.03.2023, Schadenbeispiel Treuhänder (1/2 und 2/2)

    «Den Kunden vom Treuhandbüro wurden insgesamt 130’000 Schweizer Franken gestohlen, aus einem vom Versicherten verwalteten Konto.»

    Open document: Broschüre Zurich Cyberversicherung (opens in a new window), retrieved 06.11.2026

Three ways forward