Ransomware (extortion): Garage and car dealership, Switzerland 2022
On 11 January 2022, the ransomware group Hive attacked the Emil Frey Group, one of the largest car dealers in Europe, and demanded a ransom for decryption and non-publication.
- Incident · 01.2022 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
Individual areas of the business were affected; according to a spokesperson, the systems were largely running again after a few days. The perpetrators subsequently published a file with personal data of customers from Switzerland and Germany.
- Affected
- Emil Frey Group
- Industry
- Garage and car dealership
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- according to the perpetrators around 300 GB; published file with customer data from CH and DE
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Quick restoration does not solve the second problem: stolen customer data can still be published.
Sources
- Update: Cyberkriminelle veröffentlichen interne Dokumente der Emil Frey Gruppe (opens in a new window) Netzwoche · 03.02.2022
«unsere Betriebe sind wieder operativ und alle Kunden können vollumfänglich bedient werden»