What has been confirmed?
At the end of May 2023, it became known that Swiss IT service provider Xplain AG had been affected by a ransomware attack carried out by the “Play” group. The attackers stole data and, on 14 June 2023, published what was believed to be the entire stolen data package on the dark web.
The FDPIC records an initial publication of 5 GB on 1 June and a second publication of around 420 GB on 14 June 2023, which included the first tranche. The NCSC/BACS analysed around 1.3 million published file objects.
What data was affected?
The published package contained Xplain data and data originating from the Federal Administration. According to BACS, it included classified information and sensitive personal data. The incident therefore affected not only the attacked service provider but also government and personal data stored with it.
The cited official sources do not quantify a total financial loss or confirm a period of business interruption. They also provide no information about an insurance policy or an insurance settlement for Xplain.
Cyber insurance context
No conclusion about cover can be drawn from the incident alone. Depending on the policy, potentially relevant modules may include incident response and IT forensics, legal and data protection advice, data restoration, business interruption or crisis communications. Whether and to what extent a claim is covered depends in particular on the exact wording, sublimits and exclusions, agreed security obligations and the specific claims process.
Lessons for Swiss companies
- Contracts with IT service providers should specify which data is needed, how long it is retained and how it is deleted.
- Contracts, access rights and audit options should address productive and sensitive personal data.
- A shared incident plan with service providers supports investigation, communication and recovery.
- Cyber insurance reviews should explicitly consider service-provider dependencies and the conditions attached to individual cover modules.