Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Ransomware (extortion): IT service provider and software company, Switzerland 2023

In May 2023, the group «Play» attacked the IT service provider Xplain and published captured data on the darknet.

  • Incident · 05.2023 · Switzerland
  • Evidence: confirmed by an authority
  • Ransomware (extortion)
  • Data breach
  • Attack via a supplier

As of

On this page
  1. What happened
  2. Who would have paid?
  3. Lessons
  4. Sources
  5. Similar cases

What happened

According to the NCSC report, the leak comprised around 1.3 million objects, more than 9000 of them from the federal administration; more than half of these were sensitive, including personal data, classified information and passwords. Around 95% of the federal data came from units of the FDJP.

Affected
Xplain AG
Loss
no reliable figure
Business interruption
unknown
Ransom demanded / paid
unknown / unknown
Data affected
more than 9000 data objects of the federal administration, 4779 of them sensitive (according to press reports on the NCSC report)
Bankruptcy
no
Entry point
not stated in the sources

What would cyber insurance have paid?

That depends on the terms. Whether those affected were insured: unknown.

  • Third-party claims after a data breach

    Liability for data protection and network security breaches

    Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.

  • Inform affected people

    Letters, call centre, credit monitoring

    Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.

  • Proceedings before authorities

    Costs of FDPIC or GDPR proceedings, usually not fines

    Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.

  • Reputational damage

    Loss of income because customers stay away after the incident

    Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.

  • Cyber extortion

    Help and negotiation; only some insurers pay the ransom, see note

    Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What we can learn

Customer data does not belong on the service provider’s systems if it does not need it; the supply chain is part of your own risk.

Get free advice

Sources

Similar cases

Three ways forward