Ransomware (extortion): Company, Switzerland 2024
First, a victim’s mailbox was flooded with 50 to 100 spam emails per minute.
- Incident · 10.2024 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Deception (social engineering)
As of
What happened
The attackers then got in touch as the «Help Desk» via Microsoft Teams and by telephone and sent QR codes or remote maintenance programs that downloaded malware. Behind the reported case was the ransomware group «Black Basta», which steals and encrypts data.
- Affected
- Company (anonymous)
- Industry
- other industry
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Email bombing and fake helpdesk via Microsoft Teams
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Genuine IT support does not contact you unsolicited via Teams; employees need a known reporting channel.
Sources
- Wochenrückblick Woche 44: «Black Basta» - Mittels Spam zur Verschlüsselung: Ausgeklügelte Angriffsvariante auf Unternehmen (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 05.11.2024
«Der Angriff beginnt mit dem Versand von Spam-E-Mails im Sekundentakt, im aktuellen Fall waren dies etwa 50 bis 100 E-Mails pro Minute.»