Malware: Restaurant and catering, Switzerland 2026
Attackers injected malicious code into the genuine payment page of a webshop for food orders.
- Incident · 08.2026 · Switzerland
- Evidence: confirmed by an authority
- Malware
- Data breach
As of
What happened
Instead of Twint, a fake «credit/debit card» option appeared, and the card data entered went to a domain of the perpetrators; the page then advised paying with Twint after all. The only conspicuous signs were a different layout and English texts.
- Affected
- Company (anonymous)
- Industry
- Restaurant and catering
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- no / no
- Data affected
- true
- Bankruptcy
- no
- Entry point
- JavaScript injected into the webshop’s payment page
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Contractual penalties under PCI DSS for card payments
Mostly covered 4 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Even small ordering webshops are hijacked for card skimming; plugins and shop software need updates and monitoring.
Sources
- Woche 35: Skimming bei Essenslieferdienst - Statt einem vollen Magen eine leere Kreditkarte (opens in a new window) Bundesamt für Cybersicherheit BACS · 2026-09-01
«Bei dem aktuellen Vorfall betrifft die Manipulation einen Webshop für Essensbestellungen.»