Ransomware (extortion): IT service provider and software company, Switzerland 2025
In the first half of 2025, a ransomware attack hit Cistec, a Swiss manufacturer of clinical information systems.
- Incident · 2025 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Attack via a supplier
As of
What happened
The NCSC points out that Cistec’s remote access to hospital systems could have been misused for further attacks on the hospitals. The report gives no further details on the loss.
- Affected
- Cistec
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income if the cloud or a provider is attacked
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Suppliers’ remote maintenance access is a point of entry and must be tightly restricted and monitored.
Sources
- Halbjahresbericht 2025/1 (opens in a new window) Bundesamt für Cybersicherheit BACS · 2025
«Die Fernzugriffe von Cistec auf Spitalsysteme zur Wartung ihrer Software hätten genutzt werden können, um weitere Angriffe auf die Spitäler selbst auszuführen.»
Similar cases
- Ransomware (extortion): IT service provider and software company, Switzerland 2026
- Ransomware (extortion): IT service provider and software company, Switzerland 2023
- Ransomware (extortion): IT service provider and software company, Switzerland 2023
- Ransomware (extortion): IT service provider and software company, Germany 2023