What happened?
In early November 2023, Concevis AG — a Basel-based software company developing specialised applications for Swiss authorities — fell victim to the Phobos ransomware variant. The attackers encrypted the company’s servers and exfiltrated large volumes of data, which were subsequently published on the darknet.
The incident became public on 10 November 2023 when the federal government confirmed that federal administration data was also affected. Concevis AG had access to sensitive datasets of several federal offices, including the Federal Tax Administration (FTA) and the Federal Statistical Office (FSO).
The attack was a textbook example of a supply chain attack: the federation itself was not hacked, but an external service provider through which the attackers indirectly accessed federal data.
Who was affected?
- Federal Tax Administration (FTA): Tax data of private individuals and companies potentially compromised
- Federal Statistical Office (FSO): Census data and statistical surveys affected
- Federal Office of Civil Aviation (FOCA): Aviation and safety data
- Armasuisse: Swiss Army procurement data
- Multiple cantons and municipalities using Concevis software
- Thousands of private individuals whose tax and personal data ended up on the darknet
- Concevis AG itself, which had to massively curtail its business activities after the incident
The National Cyber Security Centre (NCSC) took over coordination and classified the incident as one of the most serious cyber incidents in the history of the Swiss federal administration.
How large was the damage?
Conservative estimates suggest a total damage of CHF 10–30m, distributed across all affected parties:
- Concevis AG: Existentially threatening damage — IT restoration, customer loss, massive reputational damage
- Federation and cantons: Millions in costs for forensic analysis, data protection assessments and preventive measures
- Affected citizens: Risk of identity theft through published tax data
- Political damage: Parliamentary motions, loss of trust in digital administration
Cost analysis and insurance coverage
| Cost item | Estimated cost | Covered by cyber insurance? |
|---|---|---|
| Incident Response & Forensics | CHF 500,000–1m | Yes – immediate specialist support |
| System restoration | CHF 1–2m | Yes – IT rebuild covered |
| Notification of affected persons | CHF 200,000–500,000 | Yes – regulatory obligation |
| Data protection legal advice | CHF 500,000–1m | Yes – legal protection included |
| Third-party liability (federation/cantons) | CHF 3–10m | Yes – cyber liability component |
| Third-party damage claims | CHF 1–5m | Yes – third-party coverage |
| Business interruption | CHF 500,000–1m | Yes – revenue loss coverage |
| Crisis communication & PR | CHF 200,000–500,000 | Yes – frequently included |
| FDPIC fine | CHF 0–500,000 | Partially – depends on policy |
| Reputational damage & customer loss | CHF 5–10m | No – long-term, unquantifiable |
| Estimated total damage (Concevis) | CHF 12–32m | ~50–70% potentially covered |
A cyber insurance policy with adequate coverage (CHF 10–20m) could have been crucial to Concevis’s survival. The liability component towards government clients would have been particularly important.
Lessons for Swiss SMEs
-
IT providers as risk factor: If your software vendor is hacked, your data is affected. Check whether your IT partners have adequate security measures and cyber insurance.
-
Liability risks as a provider: If you provide software or IT services for other companies, you are liable for data losses. Cyber insurance with a liability component is essential.
-
Phobos is dangerous for SMEs too: The Phobos ransomware specifically targets smaller companies. As a Ransomware-as-a-Service (RaaS) model, it is accessible to less sophisticated attackers.
-
Data sensitivity matters: Companies handling particularly sensitive data (tax, health, personal records) carry elevated risk and should adjust their coverage accordingly.
-
Contractual protection: Clarify in your contracts with IT providers who is liable in the event of a cyber attack. Your own cyber insurance protects you regardless of your provider’s ability to pay.
-
Regular audits: Regularly review the security standards of your IT partners. Certifications like ISO 27001 are a good indicator but no guarantee.
Get a free consultation. The specialists at BTAG Versicherungsbroker AG in Bern understand the particular risks of IT service providers and companies with sensitive customer data.