Ransomware (extortion): Pharmacy and drugstore, Germany 2016
On a Friday afternoon, ransomware encrypted the pharmacy software despite antivirus protection and a firewall; the pharmacy could neither sell nor order medicines.
- Incident · 06.2016 · Hesse (Frankfurt am Main), Germany
- Evidence: confirmed by an authority
- Ransomware (extortion)
As of
What happened
The owner did not pay the Bitcoin ransom and informed customers via Facebook and notices. Only on Monday did technicians restore the system in six hours, after an outage of around two and a half days.
- Affected
- Apotheke am Lindenbaum
- Industry
- Pharmacy and drugstore
- Loss
- no reliable figure
- Business interruption
- 2.5 days
- Ransom demanded / paid
- yes / no
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Probably an email attachment (not confirmed)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
An attack on a Friday hits small businesses particularly hard if IT help only arrives on Monday; arrange round-the-clock emergency contacts.
Sources
- Apotheken-EDV: ADG-Virus legt Apotheke lahm (opens in a new window) APOTHEKE ADHOC · 2016-06-14
«Mich ärgert besonders, dass man trotz Virenschutzprogramm und Firewall nicht vor Viren gefeit ist»