Concevis ransomware 2023 — facts and lessons for SMEs

In short: The Swiss software company Concevis AG fell victim to a ransomware attack on 4 and 5 November 2023. According to the National Cyber Security Centre (now the Federal Office for Cyber Security, BACS), the attackers stole data and encrypted all of the company’s servers; the stolen data presumably included older operational data of the Federal Administration. Concevis did not pay a ransom, after which the attackers threatened to publish the data on the darknet.

Key facts at a glance

Date: Attack on 4 and 5 November 2023 (Concevis, quoted by SRF); public information by the federal government on 14 November 2023 (NCSC/BACS).
Company: Concevis AG, provider of software solutions for public administrations (federal, cantonal, municipal), the financial sector, and industry and logistics (NCSC/BACS).
Attack type: Ransomware with data theft followed by encryption of all servers (NCSC/BACS).
Confirmed impact: Presumably older operational data of the Federal Administration affected; a compromise of federal systems is considered unlikely (NCSC/BACS).
Other affected parties: At the City of Lucerne, older application data for the use of public space may be affected (City of Lucerne). At Sympany, data of a quote tool hosted at Concevis was encrypted; Sympany’s own IT systems were not affected (Sympany).
Response: Criminal complaint with the Basel-Stadt public prosecutor’s office, external security provider engaged, clients informed (NCSC/BACS).

What has been confirmed?

On 14 November 2023, the NCSC reported that the attackers first stole data and then encrypted all of Concevis’s servers. After the company did not meet the ransom demand, the attackers threatened to publish the data on the darknet.

According to the NCSC, Concevis’s clients included the Federal Office for Civil Protection, the Federal Office for Spatial Development, the Federal Statistical Office, the Federal Office of Civil Aviation, the Federal Tax Administration and the Training and Education Command. Which units and which data were actually affected was still being clarified at that time. Concevis’s applications are operated by Federal Administration service providers; analyses so far found no indication that federal systems were compromised.

On 16 November 2023, the City of Lucerne announced that it uses the Concevis application eLICET for applications to use public space. Older application data such as name, address, date of birth, phone number, email address and event details may be affected. The city ruled out any further compromise of its own systems. The health insurer Sympany reported the incident to FINMA, the FDPIC and the Federal Office of Public Health.

What is not known?

The official sources cited name neither the responsible threat group nor the attackers’ entry point. They do not quantify the ransom demand, the volume of stolen data, any financial loss or the duration of any business interruption. They do not confirm whether, or which, data was actually published. There is no information on an insurance policy or a claims settlement at Concevis.

Cyber insurance context

No coverage commitment can be derived from the incident alone. Depending on the policy, relevant modules may include incident response and IT forensics, data restoration, business interruption, legal and data protection advice, notification of affected persons, crisis communication and liability cover for claims by clients. Whether and to what extent benefits apply depends in particular on the policy wording, sub-limits and exclusions, agreed security obligations and the specific claims process.

The case is particularly relevant for software providers, because their clients’ data may be affected. For clients of such providers, the question is whether incidents at service providers are addressed in their own policy.

Lessons for Swiss SMEs

Map data held by providers: Keep a list of which software providers store which of your data, including copies and older records.
Agree on data minimisation in contracts: Define which data a provider needs, how long it keeps it and when it deletes it. The case shows that older data copies in particular can be affected.
Prepare reporting channels: Clarify in advance who informs whom after an incident at a supplier, how affected persons are notified and which supervisory bodies are relevant.
Check system separation: Check whether a compromised provider could access your own systems, and limit access to what is necessary.
Test offline backups: If all servers are encrypted, separate and regularly tested backups determine whether recovery is possible.
Check your policy for supply chain risks: Clarify with your insurer or broker how incidents at service providers and third-party liability claims are handled.

Concevis ransomware attack

Key facts at a glance

What has been confirmed?

What is not known?

Cyber insurance context

Lessons for Swiss SMEs

Sources

Have questions about cyber insurance?