Phishing: Association and foundation, Switzerland 2022
Via the Facebook Business Manager, a museum received a supposed message from the «Instagram Copyright Help Center» about a copyright infringement.
- Incident · 04.2022 · Switzerland
- Evidence: confirmed by an authority
- Phishing
- Account takeover
As of
What happened
The link led to a phishing form; the attackers took over the Instagram account and changed the login data and name. Via WhatsApp, they demanded a ransom for its return.
- Affected
- Company (anonymous)
- Industry
- Association and foundation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- Museum’s Instagram account taken over
- Bankruptcy
- no
- Entry point
- Phishing message via the Facebook Business Manager (alleged copyright infringement)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Social media accounts with many followers are a target for extortion and need two-factor protection.
Sources
- Wochenrückblick Woche 14: Hinweis zu einer angeblichen Copyright-Verletzung führt zur Übernahme des Social Media-Accounts eines Museums (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 12.04.2022
«Den Medienverantwortlichen wurde anschliessend per WhatsApp mitgeteilt, dass der gehackte Account gegen ein entsprechendes Lösegeld wieder zurückgegeben werde.»