Ransomware (extortion): Transport and logistics, Switzerland 2022
At the beginning of February 2022, a ransomware attack paralysed parts of the IT of the ground handling company Swissport.
- Incident · 02.2022 · Zurich Airport, Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
Ground services continued without IT support, but there were delays at Zurich Airport, affecting 16 to 22 flights depending on the source. The group BlackCat (ALPHV) claimed responsibility and posted stolen data on its leak site.
- Affected
- Swissport International
- Industry
- Transport and logistics
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- data stolen according to the perpetrators (according to Security Affairs, 1.6 TB offered for sale)
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Emergency operation without IT keeps critical processes running, but costs speed.
Sources
- Ransomware-Angriff auf Swissport sorgt für Flugverspätungen (opens in a new window) Netzwoche · 07.02.2022
- BlackCat gang claimed responsibility for Swissport ransomware attack (opens in a new window) Security Affairs · 2022-02