What happened?
In early February 2023, the University of Zurich (UZH) — Switzerland’s largest university — discovered a targeted cyber attack on its IT infrastructure. The attackers had gained access to internal systems and were attempting to penetrate deeper into the network.
UZH reacted swiftly: together with external cyber security experts and in close cooperation with the National Cyber Security Centre (NCSC), extensive countermeasures were initiated. Numerous IT services had to be temporarily shut down, including email systems, VPN access and internal platforms.
The attack was not a random “spray and pray” approach but a targeted operation tailored to UZH’s specific infrastructure. The attackers used multiple entry points and demonstrated a high level of technical competence. Experts did not rule out a state-sponsored actor.
Who was affected?
- Over 28,000 students whose personal data and academic records were potentially at risk
- Approximately 9,000 employees including researchers and administrative staff
- Research groups with ongoing projects
- The University Hospital Zurich (USZ), which took precautionary measures due to close IT interconnection
- Spin-off companies and industry partners
Particularly sensitive were medical research data: UZH conducts clinical studies and stores patient data subject to the Human Research Act and medical confidentiality.
How large was the damage?
The total financial damage is estimated at CHF 3–10m:
| Cost item | Estimated cost | Covered by cyber insurance? |
|---|---|---|
| Incident Response & Forensics | CHF 800,000–1.5m | Yes |
| IT system restoration | CHF 500,000–1.5m | Yes |
| Security upgrades | CHF 500,000–2m | Partially |
| Business interruption (teaching/research) | CHF 500,000–1.5m | Yes |
| Personnel costs | CHF 300,000–800,000 | Yes |
| Estimated total damage | CHF 3–10m | ~60–75% potentially covered |
Lessons for Swiss SMEs
- Underestimated attack surface: Every organisation with valuable data is a target.
- Legacy systems: Many SMEs still use outdated, unpatched software.
- Decentralised IT responsibility: A central IT security strategy is often lacking.
- Rapid response saves data: A pre-defined incident response plan is essential.
- Targeted attacks are increasing: Not only ransomware but also state actors and industrial espionage.
Get a free consultation. The experts at BTAG Versicherungsbroker AG in Bern help you realistically assess your cyber risk.