Ransomware (extortion): Production and industrial SMEs, Switzerland 2023
From 5 April 2023, the group ALPHV/BlackCat attacked the sewing machine manufacturer; sites in Thailand were also affected.
- Incident · 04.2023 · Steckborn TG, Switzerland
- Evidence: one media report
- Ransomware (extortion)
- Data breach
As of
What happened
The extortionists initially demanded around 1.3 million US dollars; later in the chat there was talk of 500'000 US dollars, and according to the report Bernina only transferred a test payment of 10 dollars. The perpetrators claimed to have captured 1200 GB of data; Bernina spoke of a considerably smaller volume and minor damage.
- Affected
- Bernina
- Industry
- Production and industrial SMEs
- Loss
- Demand of 1'316'280 US dollars; loss minor according to Bernina
- Business interruption
- unknown
- Ransom demanded / paid
- yes / unknown
- Data affected
- according to the perpetrators 450'000 files (1200 GB), according to Bernina considerably fewer
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Negotiating with extortionists buys time, but no certainty about the stolen data.
Sources
- Hacker erpressen Bernina und fordern 1,3 Millionen (opens in a new window) Beobachter · 28.04.2023