Attack via a supplier: Hotel and accommodation, Switzerland 2024
Via an old program, criminals hacked an external software provider of the hotel and captured guests’ email addresses and future stays.
- Incident · 07.2024 · Brunnen SZ, Switzerland
- Evidence: several media
- Attack via a supplier
- Phishing
- Data breach
As of
What happened
They wrote to the guests saying the reservation would be cancelled because of a payment error and asked for the credit card details via a link with a 24-hour deadline. When subsequently informing the guests, the hotel did not put the addresses in the blind copy field, so all recipients were visible.
- Affected
- Hotel Waldstätterhof
- Industry
- Hotel and accommodation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Email addresses and stay data of guests
- Bankruptcy
- no
- Entry point
- outdated program of an external software provider
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Switch off programs at service providers that are no longer used, and prepare crisis communication so that no second data protection error occurs.
Sources
- Schweizer Luxushotel wird Opfer eines Cyberangriffs (opens in a new window) Netzwoche (gestützt auf Blick) · 19.07.2024
«Der Angreifer hatte keinen Zugang zu Daten auf unserem Server und die des Software-Anbieters»
- Cyberattaque au bord du lac des Quatre-Cantons (opens in a new window) Blick (französisch) · 2024-07