Ransomware (extortion): Production and industrial SMEs, Switzerland 2019
In May 2019, according to employees, the ransomware «Ryuk» encrypted production software and data, and the backups were also unusable.
- Incident · 05.2019 · Mörschwil SG, Switzerland
- Evidence: one media report
- Ransomware (extortion)
As of
What happened
At the three sites, production was at a standstill for over a month, and late deliveries triggered contractual penalties. The company did not pay a ransom, afterwards found no investor to provide the necessary liquidity and filed for bankruptcy in February 2020; 170 employees lost their jobs.
- Affected
- Swisswindows AG
- Industry
- Production and industrial SMEs
- Loss
- Production outage of over a month and contractual penalties; no amount stated
- Business interruption
- unknown
- Ransom demanded / paid
- yes / no
- Data affected
- unknown
- Bankruptcy
- yes
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
If the backups are also encrypted, a production outage lasting weeks combined with contractual penalties can drive a company into bankruptcy.