Ransomware (extortion): IT service provider and software company, Switzerland 2023
In May 2023, the group «Play» attacked the provider of IT solutions for SMEs; most services were then offline.
- Incident · 05.2023 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
- Attack via a supplier
As of
What happened
The company set up a crisis team, reported the incident and informed its customers, but did not pay a ransom, whereupon the perpetrators published the data on the dark web. The managing director later put the costs at well over one million francs.
- Affected
- Unico Data AG
- Loss
- CHF 1'000'000
- Figure given by the source
- well over 1 million francs (statement by the managing director, quoted in the NCSC report)
- Business interruption
- unknown
- Ransom demanded / paid
- yes / no
- Data affected
- stolen data published on the dark web
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
An attack on the IT service provider also hits its SME customers; a prepared communication plan pays off.
Sources
- Halbjahresbericht 2023/2 (opens in a new window) Bundesamt für Cybersicherheit BACS · 2024
«Da die Unico Data AG kein Lösegeld bezahlte, veröffentlichte die Ransomware-Gruppe die entwendeten Daten im Darkweb.»
Similar cases
- Ransomware (extortion): IT service provider and software company, Switzerland 2026
- Ransomware (extortion): IT service provider and software company, Switzerland 2025
- Ransomware (extortion): IT service provider and software company, Switzerland 2023
- Ransomware (extortion): IT service provider and software company, Germany 2023