Ransomware and Cyber Insurance: the First 24 Hours

Short answer

In a ransomware attack, companies must first stop the spread, protect backups, preserve evidence and activate specialist help. Affected systems should be disconnected from the network; uncoordinated restarts, deletions and restores can destroy evidence or encourage reinfection. The NCSC advises against paying ransoms and recommends coordinating the next steps with the cantonal police.

Depending on the policy, cyber insurance may cover incident response, forensics, recovery, business interruption or extortion advice. It is, however, neither a blanket promise of payment nor permission to pay providers or a ransom without approval.

The first 24 hours of a ransomware attack

This timeline is an operational aid. It replaces neither the legal assessment nor the notification and consent obligations agreed in the policy.

Forensics before clean-up

The NCSC recommends securing logs and deciding early whether a forensic investigation is needed. Especially where a criminal complaint is filed, the police and forensic experts should agree on the next steps before systems are rebuilt.

In practice, this means:

• do not reset, delete or restart suspicious devices in an uncoordinated way;
• preserve ransom notes, email headers, file extensions, wallet addresses and technical indicators unchanged;
• export relevant logs from identity, email, endpoint, firewall, VPN, cloud and backup systems;
• document evidence copies, time, responsible person and storage location;
• rebuild infected systems from trusted media only after evidence has been preserved;
• before restoring, check backups for integrity and malware and make sure the attack path has been closed.

The goal is not just decryption. The infection path must be found and removed so that the attackers cannot return through unchanged accounts, remote access or vulnerabilities.

Notify the insurer immediately and document consent properly

Many cyber policies provide an emergency hotline or a network of forensic, legal and communications providers. Whether their costs are covered depends on the contract. Check in particular:

1. Who may report the claim and which number applies outside office hours?
2. Must a specific provider be used?
3. Which costs require prior written consent?
4. Is there an obligation to mitigate the loss immediately?
5. What evidence does the insurer require for downtime, additional costs and recovery?

If immediate containment is necessary, the organisation should not stand still just because a contact person has not yet replied. Document the necessity, timing, alternatives and cost of every immediate measure and obtain the contractually required approval as early as possible. Whether costs are reimbursed remains a case-by-case decision under the policy.

NCSC, FDPIC and police: three different routes

NCSC

The NCSC accepts voluntary reports of cyber incidents. In addition, since 1 April 2025, operators of critical infrastructures covered by the law have been subject to a 24-hour reporting obligation for reportable cyber attacks. This obligation does not apply to every company across the board.

FDPIC

If personal data is affected, Article 24 FADP must be assessed. A data security breach must be reported to the FDPIC as quickly as possible if it is likely to result in a high risk to the personality or fundamental rights of the persons concerned. Besides encryption, ransomware can also involve data exfiltration; the fact that the attackers have not published anything does not prove that no data was taken.

Cantonal police

For ransomware, the NCSC recommends filing a criminal complaint in every case and coordinating early with the cantonal police, especially before forensics, rebuilding or any communication with the extortionists. The NCSC itself is not a law enforcement authority.

The different thresholds and deadlines are explained in the guide to cyber reporting obligations.

Ransom, sanctions and consent

The NCSC advises against paying a ransom: payment guarantees neither decryption nor deletion of stolen data and finances the criminal business model. According to the NCSC, anyone still considering payment should urgently discuss it with the cantonal police.

The Federal Council’s 2024 report on measures against ransomware attacks stated that Switzerland would introduce neither a general ban nor a separate general reporting obligation for ransom payments. This does not mean that any specific payment is generally permissible. The current legal position and the specific recipient must be checked every time.

Particularly important:

• Swiss companies must comply with applicable sanctions. A payment or the provision of economic resources may be prohibited if sanctioned persons or organisations are involved.
• The identity and connections of the perpetrators are often unclear. A professional sanctions and legal review is therefore required before any payment decision.
• Police, legal counsel, the insurer and, where applicable, an approved extortion adviser must be coordinated.
• Neither negotiation with the extortionists nor payment may be approved merely because it is technically possible or because insurance cover is assumed.
• Ransom and related costs may be excluded, only partly covered, or subject to a separate sublimit and prior consent.

The SECO page on sanctions (in German) lists the current ordinances and the search for sanctioned persons and organisations. A real payment decision always requires an up-to-date review of the individual case.

Business interruption: waiting period, indemnity period and sublimits

“Business interruption insured” does not yet tell you how much a policy pays. For ransomware, at least these contract points should be checked:

A sublimit is a cap on benefits within the overall limit. A waiting period is not automatically the same as a monetary deductible. Only the specific wording shows how the two interact.

Policy checklist before an incident

• Emergency number and policy number available offline
• Persons authorised to report and deputies named
• Approved forensic, legal and communications partners known
• Consent for immediate costs and providers clarified
• Extortion advice and ransom reviewed separately
• Business interruption, waiting period, indemnity period and calculation understood
• Sublimits documented for each cover module
• Outage of cloud, IT and supply providers reviewed
• Security requirements and exclusions currently met
• Evidence for revenue, additional costs and restart prepared

The general coverage guide and the questions on the insurance application help with preparation.

Official and primary sources

• NCSC: Ransomware
• Federal Council: report on measures against ransomware attacks (PDF, in German)
• FDPIC: Data breach guide
• NCSC: Reporting obligation for critical infrastructures
• SECO: General information on sanctions (in German)
• Swiss Insurance Association: possible cyber insurance benefits and limits (in German)

Content reviewed on 18 July 2026. Insurance benefits, reporting obligations and legal permissibility depend on the individual case, the current legal position and the specific contract.