Malware: Company, Switzerland 2022
Malware on an employee’s private computer spied out his VPN login data.
- Incident · 06.2022 · Switzerland
- Evidence: confirmed by an authority
- Malware
- Data breach
As of
What happened
The attackers entered the company network via remote access, copied data and extorted the company by threatening to publish it. Because the private device was not under the company’s control, helpful log files were also missing.
- Affected
- Company (anonymous)
- Industry
- other industry
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- Company data copied
- Bankruptcy
- no
- Entry point
- an employee’s private device with VPN access
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Allow VPN access only from company-owned devices and with two-factor authentication.
Sources
- Wochenrückblick Woche 24: Private Geräte im Home-Office bergen hohe Risiken (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 21.06.2022
«Auslöser war eine Schadsoftware auf dem Computer eines Mitarbeitenden, welche die Zugangsdaten der VPN-Verbindung ausspionierte.»